From 99df7a234fc9f2940ffcb4ef3a38e3dfe4447d1d Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 26 Oct 2023 14:12:00 +0200
Subject: [PATCH 001/155] blank

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/__main__.py                      |  20 -
 cyclonedx_py/_internal/__init__.py            |  23 -
 cyclonedx_py/_internal/cli.py                 | 403 ------------------
 cyclonedx_py/_internal/exception/__init__.py  |  20 -
 cyclonedx_py/_internal/exception/parser.py    |  20 -
 .../_internal/license_trove_classifier.py     | 170 --------
 cyclonedx_py/_internal/parser/__init__.py     |  23 -
 .../_internal/parser/_cdx_properties.py       |  31 --
 cyclonedx_py/_internal/parser/_debug.py       |  41 --
 cyclonedx_py/_internal/parser/conda.py        | 126 ------
 cyclonedx_py/_internal/parser/environment.py  | 118 -----
 cyclonedx_py/_internal/parser/pipenv.py       | 106 -----
 cyclonedx_py/_internal/parser/poetry.py       | 115 -----
 cyclonedx_py/_internal/parser/requirements.py |  97 -----
 cyclonedx_py/_internal/utils/__init__.py      |  20 -
 cyclonedx_py/_internal/utils/conda.py         | 177 --------
 tests/__init__.py                             |  18 -
 tests/fixtures/.editorconfig                  |   4 -
 tests/fixtures/.gitattributes                 |   3 -
 tests/fixtures/conda-list-broken.txt          |   2 -
 .../fixtures/conda-list-build-number-text.txt |  45 --
 tests/fixtures/conda-list-explicit-md5.txt    |  38 --
 tests/fixtures/conda-list-explicit-simple.txt |   5 -
 tests/fixtures/conda-list-issue462.json       | 252 -----------
 tests/fixtures/conda-list-output.json         | 342 ---------------
 .../pipfile-lock-no-index-example.txt         |  46 --
 tests/fixtures/pipfile-lock-simple.txt        |  38 --
 tests/fixtures/poetry-lock11-simple.txt       |  30 --
 tests/fixtures/poetry-lock20-simple.txt       |  30 --
 tests/fixtures/requirements-example-1.txt     |   3 -
 ...requirements-local-and-remote-packages.txt |   8 -
 .../requirements-multilines-with-comments.txt |   3 -
 tests/fixtures/requirements-nested.txt        |   1 -
 .../requirements-private-packages.txt         |   3 -
 ...rements-regression-issue448.cp1252.txt.bin |   8 -
 tests/fixtures/requirements-simple.txt        |   1 -
 tests/fixtures/requirements-with-comments.txt |   5 -
 tests/fixtures/requirements-with-hashes.txt   |   5 -
 tests/fixtures/requirements-with-urls.txt     |   4 -
 .../requirements-without-pinned-versions.txt  |   5 -
 tests/integration/__init__.py                 |  18 -
 tests/integration/test_can_call_module.py     |  42 --
 tests/test_parser_conda.py                    | 161 -------
 tests/test_parser_environment.py              |  63 ---
 tests/test_parser_pipenv.py                   | 120 ------
 tests/test_parser_poetry.py                   |  86 ----
 tests/test_parser_requirements.py             | 188 --------
 tests/test_utils_conda.py                     | 187 --------
 48 files changed, 3274 deletions(-)
 delete mode 100644 cyclonedx_py/__main__.py
 delete mode 100644 cyclonedx_py/_internal/__init__.py
 delete mode 100644 cyclonedx_py/_internal/cli.py
 delete mode 100644 cyclonedx_py/_internal/exception/__init__.py
 delete mode 100644 cyclonedx_py/_internal/exception/parser.py
 delete mode 100644 cyclonedx_py/_internal/license_trove_classifier.py
 delete mode 100644 cyclonedx_py/_internal/parser/__init__.py
 delete mode 100644 cyclonedx_py/_internal/parser/_cdx_properties.py
 delete mode 100644 cyclonedx_py/_internal/parser/_debug.py
 delete mode 100644 cyclonedx_py/_internal/parser/conda.py
 delete mode 100644 cyclonedx_py/_internal/parser/environment.py
 delete mode 100644 cyclonedx_py/_internal/parser/pipenv.py
 delete mode 100644 cyclonedx_py/_internal/parser/poetry.py
 delete mode 100644 cyclonedx_py/_internal/parser/requirements.py
 delete mode 100644 cyclonedx_py/_internal/utils/__init__.py
 delete mode 100644 cyclonedx_py/_internal/utils/conda.py
 delete mode 100644 tests/__init__.py
 delete mode 100644 tests/fixtures/.editorconfig
 delete mode 100644 tests/fixtures/.gitattributes
 delete mode 100644 tests/fixtures/conda-list-broken.txt
 delete mode 100644 tests/fixtures/conda-list-build-number-text.txt
 delete mode 100644 tests/fixtures/conda-list-explicit-md5.txt
 delete mode 100644 tests/fixtures/conda-list-explicit-simple.txt
 delete mode 100644 tests/fixtures/conda-list-issue462.json
 delete mode 100644 tests/fixtures/conda-list-output.json
 delete mode 100644 tests/fixtures/pipfile-lock-no-index-example.txt
 delete mode 100644 tests/fixtures/pipfile-lock-simple.txt
 delete mode 100644 tests/fixtures/poetry-lock11-simple.txt
 delete mode 100644 tests/fixtures/poetry-lock20-simple.txt
 delete mode 100644 tests/fixtures/requirements-example-1.txt
 delete mode 100644 tests/fixtures/requirements-local-and-remote-packages.txt
 delete mode 100644 tests/fixtures/requirements-multilines-with-comments.txt
 delete mode 100644 tests/fixtures/requirements-nested.txt
 delete mode 100644 tests/fixtures/requirements-private-packages.txt
 delete mode 100644 tests/fixtures/requirements-regression-issue448.cp1252.txt.bin
 delete mode 100644 tests/fixtures/requirements-simple.txt
 delete mode 100644 tests/fixtures/requirements-with-comments.txt
 delete mode 100644 tests/fixtures/requirements-with-hashes.txt
 delete mode 100644 tests/fixtures/requirements-with-urls.txt
 delete mode 100644 tests/fixtures/requirements-without-pinned-versions.txt
 delete mode 100644 tests/integration/__init__.py
 delete mode 100644 tests/integration/test_can_call_module.py
 delete mode 100644 tests/test_parser_conda.py
 delete mode 100644 tests/test_parser_environment.py
 delete mode 100644 tests/test_parser_pipenv.py
 delete mode 100644 tests/test_parser_poetry.py
 delete mode 100644 tests/test_parser_requirements.py
 delete mode 100644 tests/test_utils_conda.py

diff --git a/cyclonedx_py/__main__.py b/cyclonedx_py/__main__.py
deleted file mode 100644
index bd87dd10..00000000
--- a/cyclonedx_py/__main__.py
+++ /dev/null
@@ -1,20 +0,0 @@
-# encoding: utf-8
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-from ._internal.cli import main
-
-main(prog_name=__package__)
diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
deleted file mode 100644
index d1d904bf..00000000
--- a/cyclonedx_py/_internal/__init__.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-"""
-This package is internal - it is not public API.
-All in here may have breaking change without notice.
-"""
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
deleted file mode 100644
index 8356fc24..00000000
--- a/cyclonedx_py/_internal/cli.py
+++ /dev/null
@@ -1,403 +0,0 @@
-#!/usr/bin/env python
-# encoding: utf-8
-
-# This file is part of CycloneDX Python
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import argparse
-import enum
-import os
-import sys
-from datetime import datetime
-from typing import Any, Optional, Type
-
-from chardet import detect as chardetect
-from cyclonedx.model import Tool
-from cyclonedx.model.bom import Bom
-from cyclonedx.model.component import Component
-from cyclonedx.output import BaseOutput, get_instance as get_output_instance
-from cyclonedx.parser import BaseParser
-from cyclonedx.schema import OutputFormat, SchemaVersion
-from cyclonedx.validation import make_schemabased_validator
-
-from .. import __version__ as _this_tool_version
-from .parser._cdx_properties import Pipenv as PipenvProps, Poetry as PoetryProp
-from .parser.conda import CondaListExplicitParser, CondaListJsonParser
-from .parser.environment import EnvironmentParser
-from .parser.pipenv import PipenvPackageCategoryGroupWellknown, PipEnvParser
-from .parser.poetry import PoetryGroupWellknown, PoetryParser
-from .parser.requirements import RequirementsParser
-
-
-class CycloneDxCmdException(Exception):
-    pass
-
-
-class CycloneDxCmdNoInputFileSupplied(CycloneDxCmdException):
-    pass
-
-
-@enum.unique
-class _CLI_OUTPUT_FORMAT(enum.Enum):
-    XML = 'xml'
-    JSON = 'json'
-
-
-@enum.unique
-class _CLI_OMITTABLE(enum.Enum):
-    DevDependencies = 'dev'
-
-
-_output_formats = {
-    _CLI_OUTPUT_FORMAT.XML: OutputFormat.XML,
-    _CLI_OUTPUT_FORMAT.JSON: OutputFormat.JSON,
-}
-_output_default_filenames = {
-    _CLI_OUTPUT_FORMAT.XML: 'cyclonedx.xml',
-    _CLI_OUTPUT_FORMAT.JSON: 'cyclonedx.json',
-}
-
-
-class CycloneDxCmd:
-    # Whether debug output is enabled
-    _DEBUG_ENABLED: bool = False
-
-    # Parsed Arguments
-    _arguments: argparse.Namespace
-
-    def __init__(self, args: argparse.Namespace) -> None:
-        self._arguments = args
-
-        if self._arguments.debug_enabled:
-            self._DEBUG_ENABLED = True
-            self._debug_message('!!! DEBUG MODE ENABLED !!!')
-            self._debug_message('Parsed Arguments: {}', self._arguments)
-
-    def _get_output_format(self) -> _CLI_OUTPUT_FORMAT:
-        return _CLI_OUTPUT_FORMAT(str(self._arguments.output_format).lower())
-
-    def get_output(self) -> BaseOutput:
-        try:
-            parser = self._get_input_parser()
-        except CycloneDxCmdNoInputFileSupplied as error:
-            print(f'ERROR: {str(error)}', file=sys.stderr)
-            exit(1)
-        except CycloneDxCmdException as error:
-            print(f'ERROR: {str(error)}', file=sys.stderr)
-            exit(1)
-
-        if parser and parser.has_warnings():
-            print('',
-                  '!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!',
-                  '!! Some of your dependencies do not have pinned version !!',
-                  '!! numbers in your requirements.txt                     !!',
-                  '!!                                                      !!',
-                  *('!! -> {} !!'.format(warning.get_item().ljust(49)) for warning in parser.get_warnings()),
-                  '!!                                                      !!',
-                  '!! The above will NOT be included in the generated      !!',
-                  '!! CycloneDX as version is a mandatory field.           !!',
-                  '!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!',
-                  '',
-                  sep='\n', file=sys.stderr)
-
-        bom = Bom(components=filter(self._component_filter, parser.get_components()))
-
-        bom.metadata.tools.add(Tool(
-            vendor='CycloneDX',
-            name='cyclonedx-bom',
-            version=_this_tool_version
-        ))
-
-        return get_output_instance(
-            bom=bom,
-            output_format=self.cdx_output_formats,
-            schema_version=self.cdx_schema_version
-        )
-
-    @property
-    def cdx_output_formats(self) -> OutputFormat:
-        return _output_formats[self._get_output_format()]
-
-    @property
-    def cdx_schema_version(self) -> SchemaVersion:
-        return SchemaVersion['V{}'.format(
-            str(self._arguments.output_schema_version).replace('.', '_')
-        )]
-
-    def execute(self) -> None:
-        output_format = self._get_output_format()
-        self._debug_message('output_format: {}', output_format)
-
-        # Quick check for JSON && SchemaVersion <= 1.1
-        if output_format is _CLI_OUTPUT_FORMAT.JSON and str(self._arguments.output_schema_version) in ['1.0', '1.1']:
-            self._error_and_exit(
-                'CycloneDX schema does not support JSON output in Schema Versions < 1.2',
-                exit_code=2
-            )
-
-        output = self.get_output().output_as_string()
-
-        if self._arguments.output_validate:
-            self._debug_message('Validating SBOM result ...')
-            validation_errors = make_schemabased_validator(
-                self.cdx_output_formats,
-                self.cdx_schema_version
-            ).validate_str(output)
-            if validation_errors is None:
-                self._debug_message('Valid SBOM result.')
-            else:
-                self._debug_message('Validation Error: {!r}', validation_errors.data)
-                self._error_and_exit(
-                    'Failed to generate valid BOM.\n\n'
-                    'Please report the issue and provide all input data to:\n'
-                    'https://github.com/CycloneDX/cyclonedx-python/issues/new?'
-                    'template=ValidationError-report.md&labels=ValidationError&title=%5BValidationError%5D',
-                    exit_code=3)
-        else:
-            self._debug_message('Validating SBOM result skipped.')
-
-        if self._arguments.output_file == '-' or not self._arguments.output_file:
-            self._debug_message('Returning SBOM to STDOUT')
-            print(output, file=sys.stdout)
-        else:
-            output_file = self._arguments.output_file
-            output_filename = os.path.realpath(
-                output_file if isinstance(output_file, str) else _output_default_filenames[output_format])
-            self._debug_message('Will be outputting SBOM to file: {}', output_filename)
-            with open(output_filename,
-                      mode='w' if self._arguments.output_file_overwrite else 'x'
-                      ) as f_out:
-                wrote = f_out.write(output)
-                self._debug_message('Wrote {} bytes to file: {}', wrote, output_filename)
-
-    @staticmethod
-    def get_arg_parser(*, prog: Optional[str] = None) -> argparse.ArgumentParser:
-        arg_parser = argparse.ArgumentParser(prog=prog, description='CycloneDX SBOM Generator')
-        arg_parser.add_argument('--version', action='version', version=_this_tool_version)
-
-        input_group = arg_parser.add_mutually_exclusive_group(required=True)
-        input_group.add_argument(
-            '-c', '--conda', action='store_true',
-            help='Build a SBOM based on the output from `conda list --explicit` or `conda list --explicit --md5`',
-            dest='input_from_conda_explicit'
-        )
-        input_group.add_argument(
-            '-cj', '--conda-json', action='store_true',
-            help='Build a SBOM based on the output from `conda list --json`',
-            dest='input_from_conda_json'
-        )
-        input_group.add_argument(
-            '-e', '--e', '--environment', action='store_true',
-            help='Build a SBOM based on the packages installed in your current Python environment (default)',
-            dest='input_from_environment'
-        )
-        input_group.add_argument(
-            '-p', '--p', '--poetry', action='store_true',
-            help='Build a SBOM based on a Poetry poetry.lock\'s contents. Use with -i to specify absolute path '
-                 'to a `poetry.lock` you wish to use, else we\'ll look for one in the current working directory.',
-            dest='input_from_poetry'
-        )
-        input_group.add_argument(
-            '-pip', '--pip', action='store_true',
-            help='Build a SBOM based on a PipEnv Pipfile.lock\'s contents. Use with -i to specify absolute path '
-                 'to a `Pipfile.lock` you wish to use, else we\'ll look for one in the current working directory.',
-            dest='input_from_pip'
-        )
-        input_group.add_argument(
-            '-r', '--r', '--requirements', action='store_true',
-            help='Build a SBOM based on a requirements.txt\'s contents. Use with -i to specify absolute path '
-                 'to a `requirements.txt` you wish to use, else we\'ll look for one in the current working directory.',
-            dest='input_from_requirements'
-        )
-
-        input_method_group = arg_parser.add_argument_group(
-            title='Input Method',
-            description='Flags to determine how this tool obtains its input'
-        )
-        input_method_group.add_argument(
-            '-i', '--in-file', action='store', metavar='FILE_PATH',
-            # custom input shall be treated as binary, the actual encoding is detected later
-            type=argparse.FileType('rb'),  # FileType does handle '-'
-            default=None,
-            help='File to read input from. Use "-" to read from STDIN.', dest='input_source', required=False
-        )
-
-        output_group = arg_parser.add_argument_group(
-            title='SBOM Output Configuration',
-            description='Choose the output format and schema version'
-        )
-        output_group.add_argument(
-            '--format', action='store',
-            choices=[f.value for f in _CLI_OUTPUT_FORMAT], default=_CLI_OUTPUT_FORMAT.XML.value,
-            help='The output format for your SBOM (default: %(default)s)',
-            dest='output_format'
-        )
-        output_group.add_argument(
-            '--schema-version', action='store', choices=['1.4', '1.3', '1.2', '1.1', '1.0'], default='1.4',
-            help='The CycloneDX schema version for your SBOM (default: %(default)s)',
-            dest='output_schema_version'
-        )
-        output_group.add_argument(
-            # string, None or True. True=autodetect(based-on-format)
-            '-o', '--o', '--output', action='store', metavar='FILE_PATH', default=True, required=False,
-            help='Output file path for your SBOM (set to \'-\' to output to STDOUT)', dest='output_file'
-        )
-        output_group.add_argument(
-            '-F', '--force', action='store_true', dest='output_file_overwrite',
-            help='If outputting to a file and the stated file already exists, it will be overwritten.'
-        )
-        output_group.add_argument(
-            '-pb', '--purl-bom-ref', action='store_true', dest='use_purl_bom_ref',
-            help="Use a component's PURL for the bom-ref value, instead of a random UUID"
-        )
-        _BooleanOptionalAction: Optional[Type[argparse.Action]] = getattr(argparse, 'BooleanOptionalAction', None)
-        # BooleanOptionalAction is not available before py39
-        if _BooleanOptionalAction:
-            output_group.add_argument(
-                '--validate', dest='output_validate',
-                help="Whether validate the result before outputting",
-                # BooleanOptionalAction is not available before py39
-                action=_BooleanOptionalAction,
-                default=True
-            )
-        else:
-            output_group.add_argument(
-                '--validate', dest='output_validate',
-                help="Validate the result before outputting",
-                action='store_true',
-                default=True
-            )
-            output_group.add_argument(
-                '--no-validate', dest='output_validate',
-                help="Do not validate the result before outputting",
-                action='store_false'
-            )
-
-        arg_parser.add_argument(
-            "--omit", dest="omit", action="append",
-            default=[],
-            help=f'Omit specified items when using Poetry or PipEnv (choice: {_CLI_OMITTABLE.DevDependencies.value})',
-        )
-
-        arg_parser.add_argument('-X', action='store_true', help='Enable debug output', dest='debug_enabled')
-
-        return arg_parser
-
-    def _debug_message(self, message: str, *args: Any, **kwargs: Any) -> None:
-        if self._DEBUG_ENABLED:
-            print(f'[DEBUG] - {{__t}} - {message}'.format(*args, **kwargs, __t=datetime.now()),
-                  file=sys.stderr)
-
-    @staticmethod
-    def _error_and_exit(message: str, *args: Any, exit_code: int = 1, **kwargs: Any) -> None:
-        print(f'[ERROR] - {{__t}} - {message}'.format(*args, **kwargs, __t=datetime.now()),
-              file=sys.stderr)
-        exit(exit_code)
-
-    def _get_input_parser(self) -> BaseParser:
-        if self._arguments.input_from_environment:
-            return EnvironmentParser(
-                use_purl_bom_ref=self._arguments.use_purl_bom_ref,
-                debug_message=lambda m, *a, **k: self._debug_message(f'EnvironmentParser {m}', *a, **k)
-            )
-
-        # All other Parsers will require some input - grab it now!
-        if not self._arguments.input_source:
-            # Nothing passed via STDIN, and no FILENAME supplied, let's assume a default by input type for ease
-            current_directory = os.getcwd()
-            try:
-                if self._arguments.input_from_conda_explicit:
-                    raise CycloneDxCmdNoInputFileSupplied(
-                        'When using input from Conda Explicit, you need to pipe input via STDIN')
-                elif self._arguments.input_from_conda_json:
-                    raise CycloneDxCmdNoInputFileSupplied(
-                        'When using input from Conda JSON, you need to pipe input via STDIN')
-                elif self._arguments.input_from_pip:
-                    self._arguments.input_source = open(os.path.join(current_directory, 'Pipfile.lock'),
-                                                        'rt', encoding="UTF-8")
-                elif self._arguments.input_from_poetry:
-                    self._arguments.input_source = open(os.path.join(current_directory, 'poetry.lock'),
-                                                        'rt', encoding="UTF-8")
-                elif self._arguments.input_from_requirements:
-                    self._arguments.input_source = open(os.path.join(current_directory, 'requirements.txt'), 'rb')
-                else:
-                    raise CycloneDxCmdException('Parser type could not be determined.')
-            except FileNotFoundError as error:
-                raise CycloneDxCmdNoInputFileSupplied(
-                    f'No input file was supplied and no input was provided on STDIN:\n{str(error)}'
-                ) from error
-
-        input_data_fh = self._arguments.input_source
-        with input_data_fh:
-            input_data = input_data_fh.read()
-            if isinstance(input_data, bytes):
-                input_encoding = (chardetect(input_data)['encoding'] or '').replace(
-                    # replace Windows-encoding with code-page
-                    'Windows-', 'cp')
-                input_data = input_data.decode(input_encoding)
-            input_data_fh.close()
-
-        if self._arguments.input_from_conda_explicit:
-            return CondaListExplicitParser(
-                conda_data=input_data,
-                use_purl_bom_ref=self._arguments.use_purl_bom_ref,
-                debug_message=lambda m, *a, **k: self._debug_message(f'CondaListExplicitParser {m}', *a, **k)
-            )
-        elif self._arguments.input_from_conda_json:
-            return CondaListJsonParser(
-                conda_data=input_data,
-                use_purl_bom_ref=self._arguments.use_purl_bom_ref,
-                debug_message=lambda m, *a, **k: self._debug_message(f'CondaListJsonParser {m}', *a, **k)
-            )
-        elif self._arguments.input_from_pip:
-            return PipEnvParser(
-                pipenv_contents=input_data,
-                use_purl_bom_ref=self._arguments.use_purl_bom_ref,
-                debug_message=lambda m, *a, **k: self._debug_message(f'PipEnvParser {m}', *a, **k)
-            )
-        elif self._arguments.input_from_poetry:
-            return PoetryParser(
-                poetry_lock_contents=input_data,
-                use_purl_bom_ref=self._arguments.use_purl_bom_ref,
-                debug_message=lambda m, *a, **k: self._debug_message(f'PoetryParser {m}', *a, **k)
-            )
-        elif self._arguments.input_from_requirements:
-            return RequirementsParser(
-                requirements_content=input_data,
-                use_purl_bom_ref=self._arguments.use_purl_bom_ref,
-                debug_message=lambda m, *a, **k: self._debug_message(f'RequirementsParser {m}', *a, **k)
-            )
-        else:
-            raise CycloneDxCmdException('Parser type could not be determined.')
-
-    def _component_filter(self, component: Component) -> bool:
-        if _CLI_OMITTABLE.DevDependencies.value in self._arguments.omit:
-            for prop in component.properties:
-                if prop.name == PipenvProps.PackageCategory.value:
-                    if prop.value == PipenvPackageCategoryGroupWellknown.Develop.value:
-                        return False
-                elif prop.name == PoetryProp.PackageGroup.value:
-                    if prop.value == PoetryGroupWellknown.Dev.value:
-                        return False
-
-        return True
-
-
-def main(*, prog_name: Optional[str] = None) -> None:
-    parser = CycloneDxCmd.get_arg_parser(prog=prog_name)
-    args = parser.parse_args()
-    CycloneDxCmd(args).execute()
diff --git a/cyclonedx_py/_internal/exception/__init__.py b/cyclonedx_py/_internal/exception/__init__.py
deleted file mode 100644
index 87d2082d..00000000
--- a/cyclonedx_py/_internal/exception/__init__.py
+++ /dev/null
@@ -1,20 +0,0 @@
-# encoding: utf-8
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-"""
-Exceptions that are specific to the CycloneDX Python implementation.
-"""
diff --git a/cyclonedx_py/_internal/exception/parser.py b/cyclonedx_py/_internal/exception/parser.py
deleted file mode 100644
index 8ca45c2e..00000000
--- a/cyclonedx_py/_internal/exception/parser.py
+++ /dev/null
@@ -1,20 +0,0 @@
-# encoding: utf-8
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-"""
-Exceptions that are specific error scenarios during occurring within Parsers in the CycloneDX library implementation.
-"""
diff --git a/cyclonedx_py/_internal/license_trove_classifier.py b/cyclonedx_py/_internal/license_trove_classifier.py
deleted file mode 100644
index bad2a7c6..00000000
--- a/cyclonedx_py/_internal/license_trove_classifier.py
+++ /dev/null
@@ -1,170 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-"""
-This module is internal - it is not public API.
-All in here may have breaking change without notice.
-"""
-
-__all__ = [
-    'PREFIX_LICENSE', 'PREFIX_OSI_APPROVED',
-    'tidy', 'to_spdx',
-]
-
-
-from typing import Optional
-
-PREFIX_LICENSE = 'License :: '
-PREFIX_OSI_APPROVED = 'OSI Approved :: '
-
-
-"""
-Map of trove classifiers to SPDX license ID or SPDX license expression.
-
-Some could be mapped to SPDX expressions, in case the version was not clear - like `(EFL-1.0 OR EFL-2.0)`.
-! But this was not done yet, for uncertainties of [PEP639](https://peps.python.org/pep-0639)
-
-classifiers: https://packaging.python.org/specifications/core-metadata/#metadata-classifier
-- of list A: https://pypi.org/pypi?%3Aaction=list_classifiers
-- of lList B: https://pypi.org/classifiers/
-
-SPDX license IDs: https://spdx.org/licenses/
-
-See also: https://peps.python.org/pep-0639/#mapping-license-classifiers-to-spdx-identifiers
-"""
-__TO_SPDX_MAP = {
-    # region not  OSI Approved
-    'License :: Aladdin Free Public License (AFPL)': 'Aladdin',
-    'License :: CC0 1.0 Universal (CC0 1.0) Public Domain Dedication': 'CC0-1.0',
-    'License :: CeCILL-B Free Software License Agreement (CECILL-B)': ' CECILL-B',
-    'License :: CeCILL-C Free Software License Agreement (CECILL-C)': 'CECILL-C',
-    # 'License :: Eiffel Forum License (EFL)': which one?
-    #   -  EFL-1.0
-    #   -  EFL-2.0
-    # 'License :: Free For Educational Use': unknown to SPDX
-    # 'License :: Free For Home Use': unknown to SPDX
-    # 'License :: Free To Use But Restricted': unknown to SPDX
-    # 'License :: Free for non-commercial use': unknown to SPDX
-    # 'License :: Freely Distributable': unknown to SPDX
-    # 'License :: Freeware': unknown to SPDX
-    'License :: GUST Font License 1.0': '',
-    # 'License :: GUST Font License 2006-09-30': unknown to SPDX
-    # 'License :: Netscape Public License (NPL)': which version?
-    #   - NPL-1.0
-    #   - NPL-1.1
-    'License :: Nokia Open Source License (NOKOS)': 'Nokia',
-    # 'License :: Other/Proprietary License': unknown to SPDX
-    # 'License :: Public Domain': unknown to SPDX
-    # 'License :: Repoze Public License': unknown to SPDX
-    # endregion not  OSI Approved
-    # region OSI Approved
-    # !! reminder: the following are OSI approved, sp map only to the SPDX that ar marked as so
-    # !! see the ideas and cases of https://peps.python.org/pep-0639/#mapping-license-classifiers-to-spdx-identifiers
-    # 'License :: OSI Approved :: Academic Free License (AFL)': which one?
-    #   -  AFL-1.1
-    #   -  AFL-3.0
-    # 'License :: OSI Approved :: Apache Software License': which one?
-    #    -  Apache-1.1
-    #    -  Apache-2.0
-    # 'License :: OSI Approved :: Apple Public Source License': which version?
-    #    -  APSL-1.0
-    #    -  APSL-2.0
-    # 'License :: OSI Approved :: Artistic License': which version?
-    'License :: OSI Approved :: Attribution Assurance License': 'AAL',
-    # 'License :: OSI Approved :: BSD License': which exactly?
-    'License :: OSI Approved :: Boost Software License 1.0 (BSL-1.0)': ' BSL-1.0',
-    'License :: OSI Approved :: CEA CNRS Inria Logiciel Libre License, version 2.1 (CeCILL-2.1)': ' CECILL-2.1',
-    'License :: OSI Approved :: Common Development and Distribution License 1.0 (CDDL-1.0)': 'CDDL-1.0',
-    'License :: OSI Approved :: Common Public License': ' CPL-1.0',
-    'License :: OSI Approved :: Eclipse Public License 1.0 (EPL-1.0)': 'EPL-1.0',
-    'License :: OSI Approved :: Eclipse Public License 2.0 (EPL-2.0)': 'EPL-1.0',
-    # 'License :: OSI Approved :: Eiffel Forum License': which version?
-    'License :: OSI Approved :: European Union Public Licence 1.0 (EUPL 1.0)': 'EUPL-1.0',
-    'License :: OSI Approved :: European Union Public Licence 1.1 (EUPL 1.1)': 'EUPL-1.1',
-    'License :: OSI Approved :: European Union Public Licence 1.2 (EUPL 1.2)': 'EUPL-1.2',
-    'License :: OSI Approved :: GNU Affero General Public License v3': 'AGPL-3.0-only',
-    'License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)': 'AGPL-3.0-or-later',
-    # 'License :: OSI Approved :: GNU Free Documentation License (FDL)': which version?
-    # 'License :: OSI Approved :: GNU General Public License (GPL)': which version?
-    'License :: OSI Approved :: GNU General Public License v2 (GPLv2)': 'GPL-2.0-only',
-    'License :: OSI Approved :: GNU General Public License v2 or later (GPLv2+)': 'GPL-2.0-or-later',
-    'License :: OSI Approved :: GNU General Public License v3 (GPLv3)': 'GPL-3.0-only',
-    'License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)': 'GPL-3.0-or-later',
-    # 'License :: OSI Approved :: GNU Lesser General Public License v2 (LGPLv2)': which one?
-    #  - LGPL-2.0-only
-    #  - LGPL-2.1-only
-    # 'License :: OSI Approved :: GNU Lesser General Public License v2 or later (LGPLv2+)': which one?
-    #  - LGPL-2.0-or-later
-    #  - LGPL-2.1-or-later
-    'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)': 'LGPL-3.0-only',
-    'License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)': 'LGPL-3.0-or-later',
-    # 'License :: OSI Approved :: GNU Library or Lesser General Public License (LGPL)': which version?
-    'License :: OSI Approved :: Historical Permission Notice and Disclaimer (HPND)': 'HPND',
-    'License :: OSI Approved :: IBM Public License': 'IPL-1.0',
-    'License :: OSI Approved :: ISC License (ISCL)': 'ISC',
-    'License :: OSI Approved :: Intel Open Source License': 'Intel',
-    # 'License :: OSI Approved :: Jabber Open Source License': unknown to SPDX
-    'License :: OSI Approved :: MIT License': 'MIT',
-    'License :: OSI Approved :: MIT No Attribution License (MIT-0)': 'MIT-0',
-    # 'License :: OSI Approved :: MITRE Collaborative Virtual Workspace License (CVW)': unknown to SPDX
-    'License :: OSI Approved :: MirOS License (MirOS)': 'MirOS',
-    'License :: OSI Approved :: Motosoto License': 'Motosoto',
-    'License :: OSI Approved :: Mozilla Public License 1.0 (MPL)': 'MPL-1.0',
-    'License :: OSI Approved :: Mozilla Public License 1.1 (MPL 1.1)': 'MPL-1.1',
-    # 'License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)': which one? MPL-XXX
-    #   - MPL-2.0
-    #   - MPL-2.0-no-copyleft-exception
-    'License :: OSI Approved :: Mulan Permissive Software License v2 (MulanPSL-2.0)': 'MulanPSL-1.0',
-    'License :: OSI Approved :: Nethack General Public License': 'NGPL',
-    'License :: OSI Approved :: Nokia Open Source License': 'Nokia',
-    'License :: OSI Approved :: Open Group Test Suite License': 'OGTSL',
-    'License :: OSI Approved :: Open Software License 3.0 (OSL-3.0)': 'OSL-3.0',
-    'License :: OSI Approved :: PostgreSQL License': 'PostgreSQL',
-    'License :: OSI Approved :: Python License (CNRI Python License)': 'CNRI-Python',
-    'License :: OSI Approved :: Python Software Foundation License': 'Python-2.0',
-    'License :: OSI Approved :: Qt Public License (QPL)': 'QPL-1.0',
-    'License :: OSI Approved :: Ricoh Source Code Public License': 'RSCPL',
-    # 'License :: OSI Approved :: SIL Open Font License 1.1 (OFL-1.1)': which one? OFL-XXX
-    #   - OFL-1.1
-    #   - OFL-1.1-no-RFN OFL-1.1-RFN
-    'License :: OSI Approved :: Sleepycat License': 'Sleepycat',
-    'License :: OSI Approved :: Sun Industry Standards Source License (SISSL)': 'SISSL',
-    'License :: OSI Approved :: Sun Public License': 'SPL-1.0',
-    'License :: OSI Approved :: The Unlicense (Unlicense)': 'Unlicense',
-    'License :: OSI Approved :: Universal Permissive License (UPL)': 'UPL-1.0',
-    'License :: OSI Approved :: University of Illinois/NCSA Open Source License': 'NCSA',
-    'License :: OSI Approved :: Vovida Software License 1.0': 'VSL-1.0',
-    'License :: OSI Approved :: W3C License': 'W3C',
-    'License :: OSI Approved :: X.Net License': 'Xnet',
-    # 'License :: OSI Approved :: Zope Public License': which one? ZPL-XXX
-    #   - ZPL-2.0
-    #   - ZPL-2.1
-    'License :: OSI Approved :: zlib/libpng License': 'Zlib',
-    # endregion OSI Approved
-}
-
-
-def to_spdx(classifier: str) -> Optional[str]:
-    """return the SPDX id or expression for a given license trove classifier"""
-    return __TO_SPDX_MAP.get(classifier)
-
-
-def tidy(classifier: str) -> str:
-    """strip license trove classifier prefixes"""
-    return classifier.replace(PREFIX_LICENSE, '').replace(PREFIX_OSI_APPROVED, '')
diff --git a/cyclonedx_py/_internal/parser/__init__.py b/cyclonedx_py/_internal/parser/__init__.py
deleted file mode 100644
index 254e5c11..00000000
--- a/cyclonedx_py/_internal/parser/__init__.py
+++ /dev/null
@@ -1,23 +0,0 @@
-# encoding: utf-8
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-"""
-Set of concrete classes and methods which allow for quick creation of a Bom instance from your environment or Python
-project.
-
-Use a Parser instead of programmatically creating a Bom as a developer.
-"""
diff --git a/cyclonedx_py/_internal/parser/_cdx_properties.py b/cyclonedx_py/_internal/parser/_cdx_properties.py
deleted file mode 100644
index 220b1a3e..00000000
--- a/cyclonedx_py/_internal/parser/_cdx_properties.py
+++ /dev/null
@@ -1,31 +0,0 @@
-# encoding: utf-8
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
-from enum import Enum
-
-
-class Poetry(Enum):
-    """See https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/poetry.md"""
-
-    PackageGroup = 'cdx:poetry:package:group'
-
-
-class Pipenv(Enum):
-    """See https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/pipenv.md"""
-
-    PackageCategory = 'cdx:pipenv:package:category'
diff --git a/cyclonedx_py/_internal/parser/_debug.py b/cyclonedx_py/_internal/parser/_debug.py
deleted file mode 100644
index 5e2e89de..00000000
--- a/cyclonedx_py/_internal/parser/_debug.py
+++ /dev/null
@@ -1,41 +0,0 @@
-# encoding: utf-8
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-"""The following structures are internal helpers."""
-
-from typing import TYPE_CHECKING, Any, Callable
-
-if TYPE_CHECKING:
-    from mypy_extensions import Arg, KwArg, VarArg
-
-    DebugMessageCallback = Callable[[Arg(str, 'message'), VarArg(Any), KwArg(Any)], None]  # noqa: F821
-    """Callback for debug messaging.
-
-    :parameter message: the format string.
-    :Other Parameters: the *args: to :func:`str.forma()`.
-    :Keyword Arguments: the **kwargs to :func:`str.format()`.
-    """
-else:
-    DebugMessageCallback = Callable[..., None]
-
-
-def quiet(message: str, *_: Any, **__: Any) -> None:
-    """Do not print anything.
-
-     Must be compatible to :py:data:`DebugMessageCallback`.
-     """
-    pass
diff --git a/cyclonedx_py/_internal/parser/conda.py b/cyclonedx_py/_internal/parser/conda.py
deleted file mode 100644
index 5edcd829..00000000
--- a/cyclonedx_py/_internal/parser/conda.py
+++ /dev/null
@@ -1,126 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import json
-from abc import ABCMeta, abstractmethod
-from typing import List
-
-from cyclonedx.model import ExternalReference, ExternalReferenceType, HashAlgorithm, HashType, XsUri
-from cyclonedx.model.component import Component
-from cyclonedx.parser import BaseParser
-
-from ..utils.conda import (
-    CondaPackage,
-    conda_package_to_purl,
-    parse_conda_json_to_conda_package,
-    parse_conda_list_str_to_conda_package,
-)
-from ._debug import DebugMessageCallback, quiet
-
-
-class _BaseCondaParser(BaseParser, metaclass=ABCMeta):
-    """Internal abstract parser - not for programmatic use.
-    """
-
-    def __init__(
-            self, conda_data: str, use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        super().__init__()
-        debug_message('init {}', self.__class__.__name__)
-        self._debug_message = debug_message
-        self._conda_packages: List[CondaPackage] = []
-        self._parse_to_conda_packages(data_str=conda_data)
-        self._conda_packages_to_components(use_purl_bom_ref=use_purl_bom_ref)
-
-    @abstractmethod
-    def _parse_to_conda_packages(self, data_str: str) -> None:
-        """
-        Abstract method for implementation by concrete Conda Parsers.
-
-        Implementation should add a `list` of `CondaPackage` instances to `self._conda_packages`
-
-        Params:
-            data_str:
-                `str` data passed into the Parser
-        """
-        pass
-
-    def _conda_packages_to_components(self, use_purl_bom_ref: bool) -> None:
-        """
-        Converts the parsed `CondaPackage` instances into `Component` instances.
-
-        """
-        self._debug_message('processing conda_packages')
-        for conda_package in self._conda_packages:
-            self._debug_message('processing conda_package: {!r}', conda_package)
-            purl = conda_package_to_purl(conda_package)
-            bom_ref = purl.to_string() if use_purl_bom_ref else None
-            c = Component(
-                name=conda_package['name'], bom_ref=bom_ref, version=conda_package['version'],
-                purl=purl
-            )
-            c.external_references.add(ExternalReference(
-                type=ExternalReferenceType.DISTRIBUTION,
-                url=XsUri(conda_package['base_url']),
-                comment=f"Distribution name {conda_package['dist_name']}"
-            ))
-            if conda_package['md5_hash'] is not None:
-                c.hashes.add(HashType(
-                    alg=HashAlgorithm.MD5,
-                    content=str(conda_package['md5_hash'])
-                ))
-
-            self._components.append(c)
-
-
-class CondaListJsonParser(_BaseCondaParser):
-    """
-    This parser is intended to receive the output from the command `conda list --json`.
-    """
-
-    def _parse_to_conda_packages(self, data_str: str) -> None:
-        conda_list_content = json.loads(data_str)
-        self._debug_message('processing conda_list_content')
-        for package in conda_list_content:
-            self._debug_message('processing package: {!r}', package)
-            conda_package = parse_conda_json_to_conda_package(conda_json_str=json.dumps(package))
-            if conda_package:
-                self._conda_packages.append(conda_package)
-            else:
-                self._debug_message('no conda_package -> skip')
-
-
-class CondaListExplicitParser(_BaseCondaParser):
-    """
-    This parser is intended to receive the output from the command `conda list --explicit` or
-    `conda list --explicit --md5`.
-    """
-
-    def _parse_to_conda_packages(self, data_str: str) -> None:
-        self._debug_message('processing data_str')
-        for line in data_str.replace('\r\n', '\n').split('\n'):
-            line = line.strip()
-            self._debug_message('processing line: {}', line)
-            conda_package = parse_conda_list_str_to_conda_package(conda_list_str=line)
-            if conda_package:
-                self._conda_packages.append(conda_package)
-            else:
-                self._debug_message('no conda_package -> skip')
diff --git a/cyclonedx_py/_internal/parser/environment.py b/cyclonedx_py/_internal/parser/environment.py
deleted file mode 100644
index 2668a4b1..00000000
--- a/cyclonedx_py/_internal/parser/environment.py
+++ /dev/null
@@ -1,118 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-"""
-Parser classes for reading installed packages in your current Python environment.
-
-These parsers look at installed packages only - not what you have defined in any dependency tool - see the other Parsers
-if you want to derive CycloneDX from declared dependencies.
-
-
-The Environment Parsers support population of the following data about Components:
-
-"""
-
-import sys
-from importlib.metadata import metadata
-
-from cyclonedx.model.license import LicenseExpression
-
-if sys.version_info >= (3, 10):
-    from importlib.metadata import PackageMetadata as _MetadataReturn
-else:
-    from email.message import Message as _MetadataReturn
-
-from cyclonedx.exception.model import CycloneDxModelException
-from cyclonedx.factory.license import LicenseFactory
-from cyclonedx.model.component import Component
-from cyclonedx.parser import BaseParser
-
-# See https://github.com/package-url/packageurl-python/issues/65
-from packageurl import PackageURL
-from pkg_resources import Distribution
-
-from ..license_trove_classifier import PREFIX_LICENSE as _LTC_PREFIX, tidy as _ltc_tidy, to_spdx as _ltc_to_spdx
-from ._debug import DebugMessageCallback, quiet
-
-
-class EnvironmentParser(BaseParser):
-    """
-    This will look at the current Python environment and list out all installed packages.
-
-    Best used when you have virtual Python environments per project.
-    """
-
-    def __init__(
-            self, use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        super().__init__()
-        debug_message('init {}', self.__class__.__name__)
-
-        debug_message('late import pkg_resources')
-        import pkg_resources
-
-        lcfac = LicenseFactory()
-
-        debug_message('processing pkg_resources.working_set')
-        i: Distribution
-        for i in iter(pkg_resources.working_set):
-            debug_message('processing working_set item: {!r}', i)
-            purl = PackageURL(type='pypi', name=i.project_name, version=i.version)
-            bom_ref = purl.to_string() if use_purl_bom_ref else None
-            c = Component(name=i.project_name, bom_ref=bom_ref, version=i.version, purl=purl)
-            licenses = set()
-
-            i_metadata = self._get_metadata_for_package(i.project_name)
-            debug_message('processing i_metadata')
-            if 'Author' in i_metadata:
-                debug_message('processing i_metadata Author: {!r}', i_metadata['Author'])
-                c.author = i_metadata['Author']
-            if 'License' in i_metadata and i_metadata['License'] and i_metadata['License'] != 'UNKNOWN':
-                debug_message('processing i_metadata License: {!r}', i_metadata['License'])
-                try:
-                    licenses.add(lcfac.make_from_string(i_metadata['License']))
-                except CycloneDxModelException as error:
-                    # @todo traceback and details to the output?
-                    debug_message('Warning: suppressed {!r}', error)
-                    del error
-
-            debug_message('processing classifiers')
-            for classifier in i_metadata.get_all("Classifier", []):
-                debug_message('processing classifier: {!r}', classifier)
-                classifier = str(classifier).strip()
-                if classifier.startswith(_LTC_PREFIX):
-                    license_string = _ltc_to_spdx(classifier) or _ltc_tidy(classifier)
-                    try:
-                        licenses.add(lcfac.make_from_string(license_string))
-                    except CycloneDxModelException as error:
-                        # @todo traceback and details to the output?
-                        debug_message('Warning: suppressed {!r}', error)
-                        del error
-
-            # assert per schema: either one expression or multiple non-expressions
-            lexp = next((li for li in licenses if isinstance(li, LicenseExpression)), None)
-            c.licenses.update([lexp] if lexp else licenses)
-
-            self._components.append(c)
-
-    @staticmethod
-    def _get_metadata_for_package(package_name: str) -> _MetadataReturn:
-        return metadata(package_name)
diff --git a/cyclonedx_py/_internal/parser/pipenv.py b/cyclonedx_py/_internal/parser/pipenv.py
deleted file mode 100644
index d5266bc6..00000000
--- a/cyclonedx_py/_internal/parser/pipenv.py
+++ /dev/null
@@ -1,106 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import json
-from enum import Enum, unique
-from typing import Any, Dict
-
-from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
-from cyclonedx.model.component import Component
-from cyclonedx.parser import BaseParser
-
-# See https://github.com/package-url/packageurl-python/issues/65
-from packageurl import PackageURL
-
-from ._cdx_properties import Pipenv as PipenvProps
-from ._debug import DebugMessageCallback, quiet
-
-
-@unique
-class PipenvPackageCategoryGroupWellknown(Enum):
-    """Wellknown package category groups.
-    See https://pipenv.pypa.io/en/latest/pipfile/#package-category-groups
-    """
-    Default = "default"
-    Develop = "develop"
-
-
-_PipenvCategoryItems = Dict[str, Dict[str, Any]]
-
-
-class PipEnvParser(BaseParser):
-
-    def __init__(
-            self, pipenv_contents: str,
-            use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        super().__init__()
-        debug_message('init {}', self.__class__.__name__)
-
-        debug_message('loading pipenv_contents')
-        pipfile_lock_contents = json.loads(pipenv_contents)
-
-        for group in PipenvPackageCategoryGroupWellknown:
-            pipfile_group: _PipenvCategoryItems = pipfile_lock_contents.get(group.value, {})
-            self._process_items(pipfile_group, group.value, use_purl_bom_ref, debug_message)
-
-    def _process_items(self, items: _PipenvCategoryItems, group: str,
-                       use_purl_bom_ref: bool,
-                       debug_message: DebugMessageCallback) -> None:
-        debug_message('processing pipfile_default {!r}', group)
-        for (package_name, package_data) in items.items():
-            debug_message('processing package: {!r} {!r}', package_name, package_data)
-            version = str(package_data.get('version') or 'unknown').lstrip('=')
-            purl = PackageURL(type='pypi', name=package_name, version=version)
-            bom_ref = purl.to_string() if use_purl_bom_ref else None
-            c = Component(name=package_name, bom_ref=bom_ref, version=version, purl=purl)
-            c.properties.add(Property(
-                name=PipenvProps.PackageCategory.value,
-                value=group))
-            if isinstance(package_data.get('hashes'), list):
-                # Add download location with hashes stored in Pipfile.lock
-                for pip_hash in package_data['hashes']:
-                    debug_message('processing pip_hash: {!r}', pip_hash)
-                    ext_ref = ExternalReference(
-                        type=ExternalReferenceType.DISTRIBUTION,
-                        url=XsUri(c.get_pypi_url()),
-                        comment='Distribution available from pypi.org'
-                    )
-                    ext_ref.hashes.add(HashType.from_composite_str(pip_hash))
-                    c.external_references.add(ext_ref)
-            self._components.append(c)
-
-
-class PipEnvFileParser(PipEnvParser):
-
-    def __init__(
-            self, pipenv_lock_filename: str,
-            use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        debug_message('open file: {}', pipenv_lock_filename)
-        with open(pipenv_lock_filename) as plf:
-            super(PipEnvFileParser, self).__init__(
-                pipenv_contents=plf.read(),
-                use_purl_bom_ref=use_purl_bom_ref,
-                debug_message=debug_message
-            )
diff --git a/cyclonedx_py/_internal/parser/poetry.py b/cyclonedx_py/_internal/parser/poetry.py
deleted file mode 100644
index 87f900a2..00000000
--- a/cyclonedx_py/_internal/parser/poetry.py
+++ /dev/null
@@ -1,115 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-from enum import Enum, unique
-
-from cyclonedx.exception.model import CycloneDxModelException
-from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
-from cyclonedx.model.component import Component
-from cyclonedx.parser import BaseParser
-
-# See https://github.com/package-url/packageurl-python/issues/65
-from packageurl import PackageURL
-from toml import loads as load_toml
-
-from ._cdx_properties import Poetry as PoetryProps
-from ._debug import DebugMessageCallback, quiet
-
-
-@unique
-class PoetryGroupWellknown(Enum):
-    """Wellknown Poetry groups.
-    See https://python-poetry.org/docs/managing-dependencies/#dependency-groups
-    """
-    Main = "main"
-    Dev = "dev"
-
-
-class PoetryParser(BaseParser):
-
-    def __init__(
-            self, poetry_lock_contents: str,
-            use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        super().__init__()
-        debug_message('init {}', self.__class__.__name__)
-
-        debug_message('loading poetry_lock_contents')
-        poetry_lock = load_toml(poetry_lock_contents)
-
-        poetry_lock_metadata = poetry_lock['metadata']
-        try:
-            poetry_lock_version = tuple(int(p) for p in str(poetry_lock_metadata['lock-version']).split('.'))
-        except Exception:
-            poetry_lock_version = (0,)
-        debug_message('detected poetry_lock_version: {!r}', poetry_lock_version)
-
-        debug_message('processing poetry_lock')
-        for package in poetry_lock['package']:
-            debug_message('processing package: {!r}', package)
-
-            purl = PackageURL(type='pypi', name=package['name'], version=package['version'])
-            bom_ref = purl.to_string() if use_purl_bom_ref else None
-            component = Component(
-                name=package['name'], bom_ref=bom_ref, version=package['version'],
-                purl=purl
-            )
-            package_category = package.get('category')
-            if package_category:
-                component.properties.add(Property(
-                    name=PoetryProps.PackageGroup.value,
-                    value=package_category))
-            debug_message('detecting package_files')
-            package_files = package['files'] \
-                if poetry_lock_version >= (2,) \
-                else poetry_lock_metadata['files'][package['name']]
-            debug_message('processing package_files: {!r}', package_files)
-            for file_metadata in package_files:
-                debug_message('processing file_metadata: {!r}', file_metadata)
-                try:
-                    component.external_references.add(ExternalReference(
-                        type=ExternalReferenceType.DISTRIBUTION,
-                        url=XsUri(component.get_pypi_url()),
-                        comment=f'Distribution file: {file_metadata["file"]}',
-                        hashes=[HashType.from_composite_str(file_metadata['hash'])]
-                    ))
-                except CycloneDxModelException as error:
-                    # @todo traceback and details to the output?
-                    debug_message('Warning: suppressed {!r}', error)
-                    del error
-            self._components.append(component)
-
-
-class PoetryFileParser(PoetryParser):
-
-    def __init__(
-            self, poetry_lock_filename: str,
-            use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        debug_message('open file: {}', poetry_lock_filename)
-        with open(poetry_lock_filename) as plf:
-            super(PoetryFileParser, self).__init__(
-                poetry_lock_contents=plf.read(),
-                use_purl_bom_ref=use_purl_bom_ref,
-                debug_message=debug_message
-            )
diff --git a/cyclonedx_py/_internal/parser/requirements.py b/cyclonedx_py/_internal/parser/requirements.py
deleted file mode 100644
index c663dbe7..00000000
--- a/cyclonedx_py/_internal/parser/requirements.py
+++ /dev/null
@@ -1,97 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import os
-import os.path
-from tempfile import NamedTemporaryFile  # Weak error
-
-from cyclonedx.model import HashType
-from cyclonedx.model.component import Component
-from cyclonedx.parser import BaseParser, ParserWarning
-
-# See https://github.com/package-url/packageurl-python/issues/65
-from packageurl import PackageURL
-from pip_requirements_parser import RequirementsFile  # type: ignore
-
-from ._debug import DebugMessageCallback, quiet
-
-
-class RequirementsParser(BaseParser):
-
-    def __init__(
-            self, requirements_content: str, use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        super().__init__()
-        debug_message('init {}', self.__class__.__name__)
-
-        if os.path.exists(requirements_content):
-            debug_message('create RequirementsFile from file: {}', requirements_content)
-            parsed_rf = RequirementsFile.from_file(requirements_content, include_nested=True)
-        else:
-            with NamedTemporaryFile(mode='w+', delete=False) as requirements_file:
-                debug_message('write requirements_content to TempFile: {}', requirements_file.name)
-                requirements_file.write(requirements_content)
-            try:
-                debug_message('create RequirementsFile from TempFile: {}', requirements_file.name)
-                parsed_rf = RequirementsFile.from_file(requirements_file.name, include_nested=False)
-            finally:
-                debug_message('unlink TempFile: {}', requirements_file.name)
-                os.unlink(requirements_file.name)
-            del requirements_file
-
-        debug_message('processing requirements')
-        for requirement in parsed_rf.requirements:
-            debug_message('processing requirement: {!r}', requirement)
-            name = requirement.link.url if requirement.is_local_path else requirement.name
-            version = requirement.get_pinned_version or requirement.dumps_specifier()
-            debug_message('detected: {!r} {!r}', name, version)
-            hashes = map(HashType.from_composite_str, requirement.hash_options)
-            if not version and not requirement.is_local_path:
-                self._warnings.append(
-                    ParserWarning(
-                        item=name,
-                        warning=(f"Requirement \'{name}\' does not have a pinned "
-                                 "version and cannot be included in your CycloneDX SBOM.")
-                    )
-                )
-            else:
-                purl = PackageURL(type='pypi', name=name, version=version)
-                bom_ref = purl.to_string() if use_purl_bom_ref else None
-                self._components.append(Component(
-                    name=name,
-                    bom_ref=bom_ref,
-                    version=version,
-                    hashes=hashes,
-                    purl=purl
-                ))
-
-
-class RequirementsFileParser(RequirementsParser):
-
-    def __init__(
-            self, requirements_file: str, use_purl_bom_ref: bool = False,
-            *,
-            debug_message: DebugMessageCallback = quiet
-    ) -> None:
-        super().__init__(
-            requirements_content=requirements_file, use_purl_bom_ref=use_purl_bom_ref,
-            debug_message=debug_message
-        )
diff --git a/cyclonedx_py/_internal/utils/__init__.py b/cyclonedx_py/_internal/utils/__init__.py
deleted file mode 100644
index 0d6867b4..00000000
--- a/cyclonedx_py/_internal/utils/__init__.py
+++ /dev/null
@@ -1,20 +0,0 @@
-# encoding: utf-8
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-"""
-Set of utility classes.
-"""
diff --git a/cyclonedx_py/_internal/utils/conda.py b/cyclonedx_py/_internal/utils/conda.py
deleted file mode 100644
index 36ff656f..00000000
--- a/cyclonedx_py/_internal/utils/conda.py
+++ /dev/null
@@ -1,177 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import json
-from json import JSONDecodeError
-from typing import Optional, Tuple, TypedDict
-from urllib.parse import urlparse
-
-# See https://github.com/package-url/packageurl-python/issues/65
-from packageurl import PackageURL
-
-
-class CondaPackage(TypedDict):
-    """
-    Internal package for unifying Conda package definitions to.
-    """
-    base_url: str
-    build_number: Optional[int]
-    build_string: str
-    channel: str
-    dist_name: str
-    name: str
-    platform: str
-    version: str
-    package_format: Optional[str]
-    md5_hash: Optional[str]
-
-
-def conda_package_to_purl(pkg: CondaPackage) -> PackageURL:
-    """
-    Return the purl for the specified package.
-    See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#conda
-    """
-    if pkg['channel'] == 'pypi' and pkg['platform'] == 'pypi':
-        return _conda_package_to_pypi_purl(pkg)
-
-    qualifiers = {
-        'build': pkg['build_string'],
-        'channel': pkg['channel'],
-        'subdir': pkg['platform'],
-    }
-    if pkg['package_format'] is not None:
-        qualifiers['type'] = str(pkg['package_format'])
-
-    purl = PackageURL(
-        type='conda', name=pkg['name'], version=pkg['version'], qualifiers=qualifiers
-    )
-    return purl
-
-
-def _conda_package_to_pypi_purl(pkg: CondaPackage) -> PackageURL:
-    """
-    Return the purl for a pip-installed package in a conda environment.
-    These packages are listed as if from the pseudo-channel "pypi".
-    See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#pypi
-    """
-    name = pkg['name'].lower().replace('_', '-')
-    purl = PackageURL(
-        type='pypi', name=name, version=pkg['version']
-    )
-    return purl
-
-
-def parse_conda_json_to_conda_package(conda_json_str: str) -> Optional[CondaPackage]:
-    try:
-        package_data = json.loads(conda_json_str)
-    except JSONDecodeError as e:
-        raise ValueError(f'Invalid JSON supplied - cannot be parsed: {conda_json_str}') from e
-
-    if not isinstance(package_data, dict):
-        return None
-
-    package_data.setdefault('package_format', None)
-    package_data.setdefault('md5_hash', None)
-    return CondaPackage(package_data)  # type: ignore # @FIXME write proper type safe dict at this point
-
-
-def parse_conda_list_str_to_conda_package(conda_list_str: str) -> Optional[CondaPackage]:
-    """
-    Helper method for parsing a line of output from `conda list --explicit` into our internal `CondaPackage` object.
-
-    Params:
-        conda_list_str:
-            Line of output from `conda list --explicit`
-
-    Returns:
-        Instance of `CondaPackage` else `None`.
-    """
-
-    line = conda_list_str.strip()
-
-    if '' == line or line[0] in ['#', '@']:
-        # Skip comments, @EXPLICT or empty lines
-        return None
-
-    # Remove any hash
-    package_hash = None
-    if '#' in line:
-        *_line_parts, package_hash = line.split('#')
-        line = ''.join(*_line_parts)
-
-    package_parts = line.split('/')
-    if len(package_parts) < 2:
-        raise ValueError(f'Unexpected format in {package_parts}')
-    *_package_url_parts, package_arch, package_name_version_build_string = package_parts
-    package_url = urlparse('/'.join(_package_url_parts))
-
-    package_name, build_version, build_string, package_format = split_package_string(package_name_version_build_string)
-    build_string, build_number = split_package_build_string(build_string)
-
-    return CondaPackage(
-        base_url=package_url.geturl(), build_number=build_number, build_string=build_string,
-        channel=package_url.path[1:], dist_name=f'{package_name}-{build_version}-{build_string}',
-        name=package_name, platform=package_arch, version=build_version, package_format=package_format,
-        md5_hash=package_hash
-    )
-
-
-def split_package_string(package_name_version_build_string: str) -> Tuple[str, str, str, str]:
-    """Helper method for parsing package_name_version_build_string.
-
-    Returns:
-        Tuple (package_name, build_version, build_string)
-    """
-    package_nvbs_parts = package_name_version_build_string.split('-')
-    if len(package_nvbs_parts) < 3:
-        raise ValueError(f'Unexpected format in {package_nvbs_parts}')
-
-    *_package_name_parts, build_version, build_string = package_nvbs_parts
-    package_name = '-'.join(_package_name_parts)
-
-    # Split package_format (.conda or .tar.gz) at the end
-    _pos = build_string.find('.')
-    package_format = build_string[_pos + 1:]
-    build_string = build_string[0:_pos]
-
-    return package_name, build_version, build_string, package_format
-
-
-def split_package_build_string(build_string: str) -> Tuple[str, Optional[int]]:
-    """Helper method for parsing build_string.
-
-    Returns:
-        Tuple (build_string, build_number)
-    """
-
-    if '' == build_string:
-        return '', None
-
-    if build_string.isdigit():
-        return '', int(build_string)
-
-    _pos = build_string.rindex('_') if '_' in build_string else -1
-    if _pos >= 1:
-        # Build number will be the last part - check if it is an integer
-        # Updated logic given https://github.com/CycloneDX/cyclonedx-python-lib/issues/65
-        build_number = build_string[_pos + 1:]
-        if build_number.isdigit():
-            return build_string, int(build_number)
-
-    return build_string, None
diff --git a/tests/__init__.py b/tests/__init__.py
deleted file mode 100644
index 308d97e7..00000000
--- a/tests/__init__.py
+++ /dev/null
@@ -1,18 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
diff --git a/tests/fixtures/.editorconfig b/tests/fixtures/.editorconfig
deleted file mode 100644
index 3de20f11..00000000
--- a/tests/fixtures/.editorconfig
+++ /dev/null
@@ -1,4 +0,0 @@
-
-[*.cp1252.txt.bin]
-charset = unset
-end_of_line = crlf
diff --git a/tests/fixtures/.gitattributes b/tests/fixtures/.gitattributes
deleted file mode 100644
index b1ce527a..00000000
--- a/tests/fixtures/.gitattributes
+++ /dev/null
@@ -1,3 +0,0 @@
-*.bin       binary
-*.txt.bin   binary diff=text
-
diff --git a/tests/fixtures/conda-list-broken.txt b/tests/fixtures/conda-list-broken.txt
deleted file mode 100644
index ed67b21c..00000000
--- a/tests/fixtures/conda-list-broken.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-# This package list id malformed.
-https://repo.anaconda.com/pkgs/main/linux-64/malformed_source.conda
diff --git a/tests/fixtures/conda-list-build-number-text.txt b/tests/fixtures/conda-list-build-number-text.txt
deleted file mode 100644
index ab3e4c27..00000000
--- a/tests/fixtures/conda-list-build-number-text.txt
+++ /dev/null
@@ -1,45 +0,0 @@
-# This file is part of https://github.com/CycloneDX/cyclonedx-python/issues/331
-
-# This file may be used to create an environment using:
-# $ conda create --name <env> --file <this file>
-# platform: linux-64
-@EXPLICIT
-https://repo.anaconda.com/pkgs/main/linux-64/_libgcc_mutex-0.1-main.conda
-https://repo.anaconda.com/pkgs/main/linux-64/ca-certificates-2022.2.1-h06a4308_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/ld_impl_linux-64-2.35.1-h7274673_9.conda
-https://repo.anaconda.com/pkgs/main/linux-64/libstdcxx-ng-9.3.0-hd4cf53a_17.conda
-https://repo.anaconda.com/pkgs/main/noarch/tzdata-2021e-hda174b7_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/libgomp-9.3.0-h5101ec6_17.conda
-https://repo.anaconda.com/pkgs/main/linux-64/_openmp_mutex-4.5-1_gnu.tar.bz2
-https://repo.anaconda.com/pkgs/main/linux-64/libgcc-ng-9.3.0-h5101ec6_17.conda
-https://repo.anaconda.com/pkgs/main/linux-64/libffi-3.3-he6710b0_2.conda
-https://repo.anaconda.com/pkgs/main/linux-64/ncurses-6.3-h7f8727e_2.conda
-https://repo.anaconda.com/pkgs/main/linux-64/openssl-1.1.1m-h7f8727e_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/xz-5.2.5-h7b6447c_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/yaml-0.2.5-h7b6447c_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/zlib-1.2.11-h7f8727e_4.conda
-https://repo.anaconda.com/pkgs/main/linux-64/readline-8.1.2-h7f8727e_1.conda
-https://repo.anaconda.com/pkgs/main/linux-64/tk-8.6.11-h1ccaba5_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/sqlite-3.38.0-hc218d9a_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/python-3.9.7-h12debd9_1.conda
-https://repo.anaconda.com/pkgs/main/linux-64/certifi-2021.10.8-py39h06a4308_2.conda
-https://repo.anaconda.com/pkgs/main/noarch/charset-normalizer-2.0.4-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/colorama-0.4.4-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/idna-3.3-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/pycosat-0.6.3-py39h27cfd23_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/pycparser-2.21-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/pysocks-1.7.1-py39h06a4308_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/ruamel_yaml-0.15.100-py39h27cfd23_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/six-1.16.0-pyhd3eb1b0_1.conda
-https://repo.anaconda.com/pkgs/main/noarch/wheel-0.37.1-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/cffi-1.15.0-py39hd667e15_1.conda
-https://repo.anaconda.com/pkgs/main/linux-64/setuptools-58.0.4-py39h06a4308_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/tqdm-4.63.0-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/brotlipy-0.7.0-py39h27cfd23_1003.conda
-https://repo.anaconda.com/pkgs/main/linux-64/conda-package-handling-1.7.3-py39h27cfd23_1.conda
-https://repo.anaconda.com/pkgs/main/linux-64/cryptography-36.0.0-py39h9ce1e76_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/pip-21.2.4-py39h06a4308_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/pyopenssl-22.0.0-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/urllib3-1.26.8-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/noarch/requests-2.27.1-pyhd3eb1b0_0.conda
-https://repo.anaconda.com/pkgs/main/linux-64/conda-4.12.0-py39h06a4308_0.conda
diff --git a/tests/fixtures/conda-list-explicit-md5.txt b/tests/fixtures/conda-list-explicit-md5.txt
deleted file mode 100644
index 4ac81284..00000000
--- a/tests/fixtures/conda-list-explicit-md5.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-# This file may be used to create an environment using:
-# $ conda create --name <env> --file <this file>
-# platform: osx-64
-@EXPLICIT
-https://repo.anaconda.com/pkgs/main/osx-64/ca-certificates-2021.7.5-hecd8cb5_1.conda#c2d0ae65c08dacdcf86770b7b5bbb187
-https://repo.anaconda.com/pkgs/main/osx-64/libcxx-10.0.0-1.conda#86574bfd5bcf4921237da41c07534cdc
-https://repo.anaconda.com/pkgs/main/noarch/tzdata-2021a-h52ac0ba_0.conda#d42e4db918af84a470286e4c300604a3
-https://repo.anaconda.com/pkgs/main/osx-64/xz-5.2.5-h1de35cc_0.conda#f38610dab0f2b0cb05f1b31f354113c5
-https://repo.anaconda.com/pkgs/main/osx-64/yaml-0.2.5-haf1e3a3_0.conda#73628ed86f99adf6a0cb81dd20e426cd
-https://repo.anaconda.com/pkgs/main/osx-64/zlib-1.2.11-h1de35cc_3.conda#67bb31afee816662edebfc3171360ccf
-https://repo.anaconda.com/pkgs/main/osx-64/libffi-3.3-hb1e8313_2.conda#0c959d444ac65555cb836cdbd3e9a2d9
-https://repo.anaconda.com/pkgs/main/osx-64/ncurses-6.2-h0a44026_1.conda#649f497ed2ff2704749256d3532d144b
-https://repo.anaconda.com/pkgs/main/osx-64/openssl-1.1.1k-h9ed2024_0.conda#2ecbfa7a9684bbaaa057c6dac778abc3
-https://repo.anaconda.com/pkgs/main/osx-64/tk-8.6.10-hb0a8c7a_0.conda#2f199f5862f5b000479408673eadb88d
-https://repo.anaconda.com/pkgs/main/osx-64/readline-8.1-h9ed2024_0.conda#ce1a650fddb885c47ccdb28c90a2057a
-https://repo.anaconda.com/pkgs/main/osx-64/sqlite-3.36.0-hce871da_0.conda#7e47a43e94a61ad1c7a5d910c5e970fd
-https://repo.anaconda.com/pkgs/main/osx-64/python-3.9.5-h88f2d9e_3.conda#f10a9a3fd6b0936cc05f9e94e06a2d94
-https://repo.anaconda.com/pkgs/main/osx-64/certifi-2021.5.30-py39hecd8cb5_0.conda#48a9d5f197fbcef83387ca18e7216068
-https://repo.anaconda.com/pkgs/main/osx-64/chardet-4.0.0-py39hecd8cb5_1003.conda#535b448899dcf60a12dc683a90be5c0c
-https://repo.anaconda.com/pkgs/main/noarch/idna-2.10-pyhd3eb1b0_0.tar.bz2#153ff132f593ea80aae2eea61a629c92
-https://repo.anaconda.com/pkgs/main/osx-64/pycosat-0.6.3-py39h9ed2024_0.conda#625905706ac243fae350f4dfc63e1b2d
-https://repo.anaconda.com/pkgs/main/noarch/pycparser-2.20-py_2.conda#fcfeb621c6f895f3562ff01d9d6ce959
-https://repo.anaconda.com/pkgs/main/osx-64/pysocks-1.7.1-py39hecd8cb5_0.conda#4765ca1a39ea5287cbe170734ac83e37
-https://repo.anaconda.com/pkgs/main/osx-64/python.app-3-py39h9ed2024_0.conda#8a562918b61f71b3cac387cec842cbd2
-https://repo.anaconda.com/pkgs/main/osx-64/ruamel_yaml-0.15.100-py39h9ed2024_0.conda#d7abc88ed5b3a8d9e4af95b8a64d87fe
-https://repo.anaconda.com/pkgs/main/noarch/six-1.16.0-pyhd3eb1b0_0.conda#529b369e1accc75b89f2d7e184a898d0
-https://repo.anaconda.com/pkgs/main/noarch/tqdm-4.61.2-pyhd3eb1b0_1.conda#f061c1548e813e7544d0017a71651e04
-https://repo.anaconda.com/pkgs/main/noarch/wheel-0.36.2-pyhd3eb1b0_0.conda#31029affc034e8c7203202417cebd157
-https://repo.anaconda.com/pkgs/main/osx-64/cffi-1.14.6-py39h2125817_0.conda#78ee9d3613c9f3f50a9eb4acd45bc747
-https://repo.anaconda.com/pkgs/main/osx-64/conda-package-handling-1.7.3-py39h9ed2024_1.conda#04a0be0e0f5bad8d8fc7ebe4803ea446
-https://repo.anaconda.com/pkgs/main/osx-64/setuptools-52.0.0-py39hecd8cb5_0.conda#5c9e48476978303d04650c21ee55f365
-https://repo.anaconda.com/pkgs/main/osx-64/brotlipy-0.7.0-py39h9ed2024_1003.conda#a08f6f5f899aff4a07351217b36fae41
-https://repo.anaconda.com/pkgs/main/osx-64/cryptography-3.4.7-py39h2fd3fbb_0.conda#822e8758f6e705c84b01480810eb24b6
-https://repo.anaconda.com/pkgs/main/osx-64/pip-21.1.3-py39hecd8cb5_0.conda#7bae540cbc7fdc9627b588c760b05e58
-https://repo.anaconda.com/pkgs/main/noarch/pyopenssl-20.0.1-pyhd3eb1b0_1.conda#ac62ddccf2e89f7a35867b2478a278af
-https://repo.anaconda.com/pkgs/main/noarch/urllib3-1.26.6-pyhd3eb1b0_1.conda#5c72bc4a5a4fc0420b0e73b3acb1f52b
-https://repo.anaconda.com/pkgs/main/noarch/requests-2.25.1-pyhd3eb1b0_0.conda#9d30b41b315403c7c74793b9b8d88580
-https://repo.anaconda.com/pkgs/main/osx-64/conda-4.10.3-py39hecd8cb5_0.tar.bz2#bc36833ee4a90c212e0695675bcfe120
diff --git a/tests/fixtures/conda-list-explicit-simple.txt b/tests/fixtures/conda-list-explicit-simple.txt
deleted file mode 100644
index b9cd27fb..00000000
--- a/tests/fixtures/conda-list-explicit-simple.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-# This file may be used to create an environment using:
-# $ conda create --name <env> --file <this file>
-# platform: osx-64
-@EXPLICIT
-https://repo.anaconda.com/pkgs/main/osx-64/setuptools-52.0.0-py39hecd8cb5_0.conda#5c9e48476978303d04650c21ee55f365
\ No newline at end of file
diff --git a/tests/fixtures/conda-list-issue462.json b/tests/fixtures/conda-list-issue462.json
deleted file mode 100644
index 8e900588..00000000
--- a/tests/fixtures/conda-list-issue462.json
+++ /dev/null
@@ -1,252 +0,0 @@
-[
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "main",
-    "channel": "pkgs/main",
-    "dist_name": "_libgcc_mutex-0.1-main",
-    "name": "_libgcc_mutex",
-    "platform": "linux-64",
-    "version": "0.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "1_gnu",
-    "channel": "pkgs/main",
-    "dist_name": "_openmp_mutex-5.1-1_gnu",
-    "name": "_openmp_mutex",
-    "platform": "linux-64",
-    "version": "5.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h7b6447c_0",
-    "channel": "pkgs/main",
-    "dist_name": "bzip2-1.0.8-h7b6447c_0",
-    "name": "bzip2",
-    "platform": "linux-64",
-    "version": "1.0.8"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h06a4308_0",
-    "channel": "pkgs/main",
-    "dist_name": "ca-certificates-2022.10.11-h06a4308_0",
-    "name": "ca-certificates",
-    "platform": "linux-64",
-    "version": "2022.10.11"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py310h06a4308_0",
-    "channel": "pkgs/main",
-    "dist_name": "certifi-2022.9.24-py310h06a4308_0",
-    "name": "certifi",
-    "platform": "linux-64",
-    "version": "2022.9.24"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "h1181459_1",
-    "channel": "pkgs/main",
-    "dist_name": "ld_impl_linux-64-2.38-h1181459_1",
-    "name": "ld_impl_linux-64",
-    "platform": "linux-64",
-    "version": "2.38"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 6,
-    "build_string": "h6a678d5_6",
-    "channel": "pkgs/main",
-    "dist_name": "libffi-3.4.2-h6a678d5_6",
-    "name": "libffi",
-    "platform": "linux-64",
-    "version": "3.4.2"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "h1234567_1",
-    "channel": "pkgs/main",
-    "dist_name": "libgcc-ng-11.2.0-h1234567_1",
-    "name": "libgcc-ng",
-    "platform": "linux-64",
-    "version": "11.2.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "h1234567_1",
-    "channel": "pkgs/main",
-    "dist_name": "libgomp-11.2.0-h1234567_1",
-    "name": "libgomp",
-    "platform": "linux-64",
-    "version": "11.2.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "h1234567_1",
-    "channel": "pkgs/main",
-    "dist_name": "libstdcxx-ng-11.2.0-h1234567_1",
-    "name": "libstdcxx-ng",
-    "platform": "linux-64",
-    "version": "11.2.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h5eee18b_0",
-    "channel": "pkgs/main",
-    "dist_name": "libuuid-1.41.5-h5eee18b_0",
-    "name": "libuuid",
-    "platform": "linux-64",
-    "version": "1.41.5"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 3,
-    "build_string": "h5eee18b_3",
-    "channel": "pkgs/main",
-    "dist_name": "ncurses-6.3-h5eee18b_3",
-    "name": "ncurses",
-    "platform": "linux-64",
-    "version": "6.3"
-  },
-  {
-    "base_url": "https://conda.anaconda.org/pypi",
-    "build_number": 0,
-    "build_string": "pypi_0",
-    "channel": "pypi",
-    "dist_name": "numpy-1.23.5-pypi_0",
-    "name": "numpy",
-    "platform": "pypi",
-    "version": "1.23.5"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h7f8727e_0",
-    "channel": "pkgs/main",
-    "dist_name": "openssl-1.1.1s-h7f8727e_0",
-    "name": "openssl",
-    "platform": "linux-64",
-    "version": "1.1.1s"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py310h06a4308_0",
-    "channel": "pkgs/main",
-    "dist_name": "pip-22.3.1-py310h06a4308_0",
-    "name": "pip",
-    "platform": "linux-64",
-    "version": "22.3.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "h7a1cb2a_1",
-    "channel": "pkgs/main",
-    "dist_name": "python-3.10.8-h7a1cb2a_1",
-    "name": "python",
-    "platform": "linux-64",
-    "version": "3.10.8"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h5eee18b_0",
-    "channel": "pkgs/main",
-    "dist_name": "readline-8.2-h5eee18b_0",
-    "name": "readline",
-    "platform": "linux-64",
-    "version": "8.2"
-  },
-  {
-    "base_url": "https://conda.anaconda.org/pypi",
-    "build_number": 0,
-    "build_string": "pypi_0",
-    "channel": "pypi",
-    "dist_name": "seawater-3.3.4-pypi_0",
-    "name": "seawater",
-    "platform": "pypi",
-    "version": "3.3.4"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py310h06a4308_0",
-    "channel": "pkgs/main",
-    "dist_name": "setuptools-65.5.0-py310h06a4308_0",
-    "name": "setuptools",
-    "platform": "linux-64",
-    "version": "65.5.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h5082296_0",
-    "channel": "pkgs/main",
-    "dist_name": "sqlite-3.40.0-h5082296_0",
-    "name": "sqlite",
-    "platform": "linux-64",
-    "version": "3.40.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h1ccaba5_0",
-    "channel": "pkgs/main",
-    "dist_name": "tk-8.6.12-h1ccaba5_0",
-    "name": "tk",
-    "platform": "linux-64",
-    "version": "8.6.12"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h04d1e81_0",
-    "channel": "pkgs/main",
-    "dist_name": "tzdata-2022g-h04d1e81_0",
-    "name": "tzdata",
-    "platform": "noarch",
-    "version": "2022g"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "pyhd3eb1b0_0",
-    "channel": "pkgs/main",
-    "dist_name": "wheel-0.37.1-pyhd3eb1b0_0",
-    "name": "wheel",
-    "platform": "noarch",
-    "version": "0.37.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h5eee18b_0",
-    "channel": "pkgs/main",
-    "dist_name": "xz-5.2.8-h5eee18b_0",
-    "name": "xz",
-    "platform": "linux-64",
-    "version": "5.2.8"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h5eee18b_0",
-    "channel": "pkgs/main",
-    "dist_name": "zlib-1.2.13-h5eee18b_0",
-    "name": "zlib",
-    "platform": "linux-64",
-    "version": "1.2.13"
-  }
-]
diff --git a/tests/fixtures/conda-list-output.json b/tests/fixtures/conda-list-output.json
deleted file mode 100644
index a0739965..00000000
--- a/tests/fixtures/conda-list-output.json
+++ /dev/null
@@ -1,342 +0,0 @@
-[
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1003,
-    "build_string": "py39h9ed2024_1003",
-    "channel": "pkgs/main",
-    "dist_name": "brotlipy-0.7.0-py39h9ed2024_1003",
-    "name": "brotlipy",
-    "platform": "osx-64",
-    "version": "0.7.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "hecd8cb5_1",
-    "channel": "pkgs/main",
-    "dist_name": "ca-certificates-2021.7.5-hecd8cb5_1",
-    "name": "ca-certificates",
-    "platform": "osx-64",
-    "version": "2021.7.5"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39hecd8cb5_0",
-    "channel": "pkgs/main",
-    "dist_name": "certifi-2021.5.30-py39hecd8cb5_0",
-    "name": "certifi",
-    "platform": "osx-64",
-    "version": "2021.5.30"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39h2125817_0",
-    "channel": "pkgs/main",
-    "dist_name": "cffi-1.14.6-py39h2125817_0",
-    "name": "cffi",
-    "platform": "osx-64",
-    "version": "1.14.6"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1003,
-    "build_string": "py39hecd8cb5_1003",
-    "channel": "pkgs/main",
-    "dist_name": "chardet-4.0.0-py39hecd8cb5_1003",
-    "name": "chardet",
-    "platform": "osx-64",
-    "version": "4.0.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39hecd8cb5_0",
-    "channel": "pkgs/main",
-    "dist_name": "conda-4.10.3-py39hecd8cb5_0",
-    "name": "conda",
-    "platform": "osx-64",
-    "version": "4.10.3"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "py39h9ed2024_1",
-    "channel": "pkgs/main",
-    "dist_name": "conda-package-handling-1.7.3-py39h9ed2024_1",
-    "name": "conda-package-handling",
-    "platform": "osx-64",
-    "version": "1.7.3"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39h2fd3fbb_0",
-    "channel": "pkgs/main",
-    "dist_name": "cryptography-3.4.7-py39h2fd3fbb_0",
-    "name": "cryptography",
-    "platform": "osx-64",
-    "version": "3.4.7"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "pyhd3eb1b0_0",
-    "channel": "pkgs/main",
-    "dist_name": "idna-2.10-pyhd3eb1b0_0",
-    "name": "idna",
-    "platform": "noarch",
-    "version": "2.10"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "1",
-    "channel": "pkgs/main",
-    "dist_name": "libcxx-10.0.0-1",
-    "name": "libcxx",
-    "platform": "osx-64",
-    "version": "10.0.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 2,
-    "build_string": "hb1e8313_2",
-    "channel": "pkgs/main",
-    "dist_name": "libffi-3.3-hb1e8313_2",
-    "name": "libffi",
-    "platform": "osx-64",
-    "version": "3.3"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "h0a44026_1",
-    "channel": "pkgs/main",
-    "dist_name": "ncurses-6.2-h0a44026_1",
-    "name": "ncurses",
-    "platform": "osx-64",
-    "version": "6.2"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h9ed2024_0",
-    "channel": "pkgs/main",
-    "dist_name": "openssl-1.1.1k-h9ed2024_0",
-    "name": "openssl",
-    "platform": "osx-64",
-    "version": "1.1.1k"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39hecd8cb5_0",
-    "channel": "pkgs/main",
-    "dist_name": "pip-21.1.3-py39hecd8cb5_0",
-    "name": "pip",
-    "platform": "osx-64",
-    "version": "21.1.3"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39h9ed2024_0",
-    "channel": "pkgs/main",
-    "dist_name": "pycosat-0.6.3-py39h9ed2024_0",
-    "name": "pycosat",
-    "platform": "osx-64",
-    "version": "0.6.3"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 2,
-    "build_string": "py_2",
-    "channel": "pkgs/main",
-    "dist_name": "pycparser-2.20-py_2",
-    "name": "pycparser",
-    "platform": "noarch",
-    "version": "2.20"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "pyhd3eb1b0_1",
-    "channel": "pkgs/main",
-    "dist_name": "pyopenssl-20.0.1-pyhd3eb1b0_1",
-    "name": "pyopenssl",
-    "platform": "noarch",
-    "version": "20.0.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39hecd8cb5_0",
-    "channel": "pkgs/main",
-    "dist_name": "pysocks-1.7.1-py39hecd8cb5_0",
-    "name": "pysocks",
-    "platform": "osx-64",
-    "version": "1.7.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 3,
-    "build_string": "h88f2d9e_3",
-    "channel": "pkgs/main",
-    "dist_name": "python-3.9.5-h88f2d9e_3",
-    "name": "python",
-    "platform": "osx-64",
-    "version": "3.9.5"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39h9ed2024_0",
-    "channel": "pkgs/main",
-    "dist_name": "python.app-3-py39h9ed2024_0",
-    "name": "python.app",
-    "platform": "osx-64",
-    "version": "3"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h9ed2024_0",
-    "channel": "pkgs/main",
-    "dist_name": "readline-8.1-h9ed2024_0",
-    "name": "readline",
-    "platform": "osx-64",
-    "version": "8.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "pyhd3eb1b0_0",
-    "channel": "pkgs/main",
-    "dist_name": "requests-2.25.1-pyhd3eb1b0_0",
-    "name": "requests",
-    "platform": "noarch",
-    "version": "2.25.1"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39h9ed2024_0",
-    "channel": "pkgs/main",
-    "dist_name": "ruamel_yaml-0.15.100-py39h9ed2024_0",
-    "name": "ruamel_yaml",
-    "platform": "osx-64",
-    "version": "0.15.100"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "py39hecd8cb5_0",
-    "channel": "pkgs/main",
-    "dist_name": "setuptools-52.0.0-py39hecd8cb5_0",
-    "name": "setuptools",
-    "platform": "osx-64",
-    "version": "52.0.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "pyhd3eb1b0_0",
-    "channel": "pkgs/main",
-    "dist_name": "six-1.16.0-pyhd3eb1b0_0",
-    "name": "six",
-    "platform": "noarch",
-    "version": "1.16.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "hce871da_0",
-    "channel": "pkgs/main",
-    "dist_name": "sqlite-3.36.0-hce871da_0",
-    "name": "sqlite",
-    "platform": "osx-64",
-    "version": "3.36.0"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "hb0a8c7a_0",
-    "channel": "pkgs/main",
-    "dist_name": "tk-8.6.10-hb0a8c7a_0",
-    "name": "tk",
-    "platform": "osx-64",
-    "version": "8.6.10"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "pyhd3eb1b0_1",
-    "channel": "pkgs/main",
-    "dist_name": "tqdm-4.61.2-pyhd3eb1b0_1",
-    "name": "tqdm",
-    "platform": "noarch",
-    "version": "4.61.2"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h52ac0ba_0",
-    "channel": "pkgs/main",
-    "dist_name": "tzdata-2021a-h52ac0ba_0",
-    "name": "tzdata",
-    "platform": "noarch",
-    "version": "2021a"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 1,
-    "build_string": "pyhd3eb1b0_1",
-    "channel": "pkgs/main",
-    "dist_name": "urllib3-1.26.6-pyhd3eb1b0_1",
-    "name": "urllib3",
-    "platform": "noarch",
-    "version": "1.26.6"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "pyhd3eb1b0_0",
-    "channel": "pkgs/main",
-    "dist_name": "wheel-0.36.2-pyhd3eb1b0_0",
-    "name": "wheel",
-    "platform": "noarch",
-    "version": "0.36.2"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "h1de35cc_0",
-    "channel": "pkgs/main",
-    "dist_name": "xz-5.2.5-h1de35cc_0",
-    "name": "xz",
-    "platform": "osx-64",
-    "version": "5.2.5"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 0,
-    "build_string": "haf1e3a3_0",
-    "channel": "pkgs/main",
-    "dist_name": "yaml-0.2.5-haf1e3a3_0",
-    "name": "yaml",
-    "platform": "osx-64",
-    "version": "0.2.5"
-  },
-  {
-    "base_url": "https://repo.anaconda.com/pkgs/main",
-    "build_number": 3,
-    "build_string": "h1de35cc_3",
-    "channel": "pkgs/main",
-    "dist_name": "zlib-1.2.11-h1de35cc_3",
-    "name": "zlib",
-    "platform": "osx-64",
-    "version": "1.2.11"
-  }
-]
diff --git a/tests/fixtures/pipfile-lock-no-index-example.txt b/tests/fixtures/pipfile-lock-no-index-example.txt
deleted file mode 100644
index 6e1db75b..00000000
--- a/tests/fixtures/pipfile-lock-no-index-example.txt
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-    "_meta": {
-        "hash": {
-            "sha256": "8ca3da46acf801a7780c6781bed1d6b7012664226203447640cda114b13aa8aa"
-        },
-        "pipfile-spec": 6,
-        "requires": {
-            "python_version": "3.9"
-        },
-        "sources": [
-            {
-                "name": "pypi",
-                "url": "https://pypi.org/simple",
-                "verify_ssl": true
-            }
-        ]
-    },
-    "default": {
-        "anyio": {
-            "hashes": [
-                "sha256:56ceaeed2877723578b1341f4f68c29081db189cfb40a97d1922b9513f6d7db6",
-                "sha256:8eccec339cb4a856c94a75d50fc1d451faf32a05ef406be462e2efc59c9838b0"
-            ],
-            "markers": "python_full_version >= '3.6.2'",
-            "version": "==3.3.3"
-        },
-        "toml": {
-            "hashes": [
-                "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
-                "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
-            ],
-            "index": "pypi",
-            "version": "==0.10.2"
-        }
-    },
-    "develop": {
-        "flake8": {
-            "hashes": [
-                "sha256:45681a117ecc81e870cbf1262835ae4af5e7a8b08e40b944a8a6e6b895914cfb",
-                "sha256:49356e766643ad15072a789a20915d3c91dc89fd313ccd71802303fd67e4deca"
-            ],
-            "index": "pip_conf_index_global",
-            "version": "==3.7.9"
-        }
-    }
-}
diff --git a/tests/fixtures/pipfile-lock-simple.txt b/tests/fixtures/pipfile-lock-simple.txt
deleted file mode 100644
index 8d12d2a1..00000000
--- a/tests/fixtures/pipfile-lock-simple.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-    "_meta": {
-        "hash": {
-            "sha256": "8ca3da46acf801a7780c6781bed1d6b7012664226203447640cda114b13aa8aa"
-        },
-        "pipfile-spec": 6,
-        "requires": {
-            "python_version": "3.9"
-        },
-        "sources": [
-            {
-                "name": "pypi",
-                "url": "https://pypi.org/simple",
-                "verify_ssl": true
-            }
-        ]
-    },
-    "default": {
-        "toml": {
-            "hashes": [
-                "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
-                "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
-            ],
-            "index": "pypi",
-            "version": "==0.10.2"
-        }
-    },
-    "develop": {
-        "flake8": {
-            "hashes": [
-                "sha256:45681a117ecc81e870cbf1262835ae4af5e7a8b08e40b944a8a6e6b895914cfb",
-                "sha256:49356e766643ad15072a789a20915d3c91dc89fd313ccd71802303fd67e4deca"
-            ],
-            "index": "pip_conf_index_global",
-            "version": "==3.7.9"
-        }
-    }
-}
diff --git a/tests/fixtures/poetry-lock11-simple.txt b/tests/fixtures/poetry-lock11-simple.txt
deleted file mode 100644
index de7931e9..00000000
--- a/tests/fixtures/poetry-lock11-simple.txt
+++ /dev/null
@@ -1,30 +0,0 @@
-[[package]]
-name = "ddt"
-version = "1.6.0"
-description = "Data-Driven/Decorated Tests"
-category = "dev"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "toml"
-version = "0.10.2"
-description = "Python Library for Tom's Obvious, Minimal Language"
-category = "main"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-
-[metadata]
-lock-version = "1.1"
-python-versions = "^3.9"
-content-hash = "80097fa9563a7be19fa76849b17ca2426c48bd289f946f9f08bfdf07f458ed88"
-
-[metadata.files]
-ddt = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-toml = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
diff --git a/tests/fixtures/poetry-lock20-simple.txt b/tests/fixtures/poetry-lock20-simple.txt
deleted file mode 100644
index 90d20d32..00000000
--- a/tests/fixtures/poetry-lock20-simple.txt
+++ /dev/null
@@ -1,30 +0,0 @@
-# This file is automatically @generated by Poetry 1.4.1 and should not be changed by hand.
-
-[[package]]
-name = "ddt"
-version = "1.6.0"
-description = "Data-Driven/Decorated Tests"
-category = "dev"
-optional = false
-python-versions = "*"
-files = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-
-[[package]]
-name = "toml"
-version = "0.10.2"
-description = "Python Library for Tom's Obvious, Minimal Language"
-category = "main"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
-
-[metadata]
-lock-version = "2.0"
-python-versions = "^3.9"
-content-hash = "e808a516cc6e4eab5306d2aa5e1bc464824c23805ebaa47ffc9e64146d12c613"
diff --git a/tests/fixtures/requirements-example-1.txt b/tests/fixtures/requirements-example-1.txt
deleted file mode 100644
index ea71d69b..00000000
--- a/tests/fixtures/requirements-example-1.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-packageurl-python>=0.9.4
-requirements_parser>=0.2.0
-setuptools>=50.3.2
\ No newline at end of file
diff --git a/tests/fixtures/requirements-local-and-remote-packages.txt b/tests/fixtures/requirements-local-and-remote-packages.txt
deleted file mode 100644
index 441452de..00000000
--- a/tests/fixtures/requirements-local-and-remote-packages.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-./myproject/certifi # comment
-./myproject/chardet
--e ./myproject/idna.whl
-./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804
-./myproject/urllib3
-https://example.com/mypackage-0.0.1-cp37-none-linux_amd64.whl  # WHL filename must be conformant to PEP-440
-
--r requirements-nested.txt
diff --git a/tests/fixtures/requirements-multilines-with-comments.txt b/tests/fixtures/requirements-multilines-with-comments.txt
deleted file mode 100644
index 163e161f..00000000
--- a/tests/fixtures/requirements-multilines-with-comments.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-certifi==2021.5.30 \
-    --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee
-# via requests
\ No newline at end of file
diff --git a/tests/fixtures/requirements-nested.txt b/tests/fixtures/requirements-nested.txt
deleted file mode 100644
index cf4d7c0a..00000000
--- a/tests/fixtures/requirements-nested.txt
+++ /dev/null
@@ -1 +0,0 @@
-./downloads/numpy-1.9.2-cp34-none-win32.whl
diff --git a/tests/fixtures/requirements-private-packages.txt b/tests/fixtures/requirements-private-packages.txt
deleted file mode 100644
index dca55ced..00000000
--- a/tests/fixtures/requirements-private-packages.txt
+++ /dev/null
@@ -1,3 +0,0 @@
---extra-index-url https://mypi.org/simple/
-
-mypackage==1.2.3
diff --git a/tests/fixtures/requirements-regression-issue448.cp1252.txt.bin b/tests/fixtures/requirements-regression-issue448.cp1252.txt.bin
deleted file mode 100644
index 3ae70eb8..00000000
--- a/tests/fixtures/requirements-regression-issue448.cp1252.txt.bin
+++ /dev/null
@@ -1,8 +0,0 @@
-# This is a regression test for https://github.com/CycloneDX/cyclonedx-python/issues/448
-# This file is in `cp1252` encoding - on purpose
-# This file uses CRLF for line endings - on purpose
-# some encoding specific characters: ���������������������������
-
-packageurl-python>=0.9.4
-requirements_parser>=0.2.0
-setuptools>=50.3.2
diff --git a/tests/fixtures/requirements-simple.txt b/tests/fixtures/requirements-simple.txt
deleted file mode 100644
index 890d7da2..00000000
--- a/tests/fixtures/requirements-simple.txt
+++ /dev/null
@@ -1 +0,0 @@
-setuptools==50.3.2
\ No newline at end of file
diff --git a/tests/fixtures/requirements-with-comments.txt b/tests/fixtures/requirements-with-comments.txt
deleted file mode 100644
index 2d9c4a1a..00000000
--- a/tests/fixtures/requirements-with-comments.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-certifi==2021.5.30 # via requests
-chardet==4.0.0 # via requests
-idna==2.10 # via requests
-requests==2.25.1 # via -r requirements.in
-urllib3==1.26.5 # via requests
\ No newline at end of file
diff --git a/tests/fixtures/requirements-with-hashes.txt b/tests/fixtures/requirements-with-hashes.txt
deleted file mode 100644
index 03ec1169..00000000
--- a/tests/fixtures/requirements-with-hashes.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8 # via requests
-chardet==4.0.0 --hash=sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa --hash=sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5 # via requests
-idna==2.10 --hash=sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6 --hash=sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0 # via requests
-requests==2.25.1 --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804 --hash=sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e # via -r requirements.in
-urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098 # via requests
\ No newline at end of file
diff --git a/tests/fixtures/requirements-with-urls.txt b/tests/fixtures/requirements-with-urls.txt
deleted file mode 100644
index d6df7180..00000000
--- a/tests/fixtures/requirements-with-urls.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-git+https://github.com/path/to/package-one@41b95ec#egg=package-one # commit hash
-git+https://github.com/path/to/package-two@master#egg=package-two # master branch
-git+https://github.com/path/to/package-three@0.1#egg=package-three # tag
-git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four # release tag
diff --git a/tests/fixtures/requirements-without-pinned-versions.txt b/tests/fixtures/requirements-without-pinned-versions.txt
deleted file mode 100644
index b25c0778..00000000
--- a/tests/fixtures/requirements-without-pinned-versions.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-certifi==2021.5.30 # via requests
-chardet>=4.0.0 # via requests
-idna
-requests
-urllib3
\ No newline at end of file
diff --git a/tests/integration/__init__.py b/tests/integration/__init__.py
deleted file mode 100644
index 308d97e7..00000000
--- a/tests/integration/__init__.py
+++ /dev/null
@@ -1,18 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
diff --git a/tests/integration/test_can_call_module.py b/tests/integration/test_can_call_module.py
deleted file mode 100644
index b9c19047..00000000
--- a/tests/integration/test_can_call_module.py
+++ /dev/null
@@ -1,42 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import subprocess  # nosec B404
-import sys
-from unittest import TestCase
-
-import cyclonedx_py
-
-
-class TestCli(TestCase):
-
-    def test_callable_as_module(self) -> None:
-        args = [sys.executable, '-m', cyclonedx_py.__name__, '--help']
-
-        # Test whether the call passed, is fair enough for now.
-        # Additional tests may come later, to check output etc.
-        ran = subprocess.run(  # nosec B603
-            args,
-            stdout=subprocess.PIPE, stderr=subprocess.PIPE,
-            shell=False
-        )
-
-        self.assertEqual(0, ran.returncode, msg='subprocess returned unexpected non-zero\n'
-                                                f'out: {ran.stdout}\n'
-                                                f'err: {ran.stderr}')
diff --git a/tests/test_parser_conda.py b/tests/test_parser_conda.py
deleted file mode 100644
index a1a01d63..00000000
--- a/tests/test_parser_conda.py
+++ /dev/null
@@ -1,161 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import os
-import re
-from unittest import TestCase
-
-from cyclonedx.model import HashAlgorithm, HashType
-
-from cyclonedx_py._internal.parser.conda import CondaListExplicitParser, CondaListJsonParser
-
-
-class TestCondaParser(TestCase):
-
-    def test_conda_list_json(self) -> None:
-        conda_list_output_file = os.path.join(os.path.dirname(__file__),
-                                              'fixtures/conda-list-output.json')
-
-        with (open(conda_list_output_file, 'r')) as conda_list_output_fh:
-            parser = CondaListJsonParser(conda_data=conda_list_output_fh.read())
-
-        self.assertEqual(34, parser.component_count())
-        components = parser.get_components()
-
-        c_idna = next(filter(lambda c: c.name == 'idna', components), None)
-        self.assertIsNotNone(c_idna)
-        self.assertEqual('idna', c_idna.name)
-        self.assertNotEqual(c_idna.purl.to_string(), c_idna.bom_ref.value)
-        self.assertEqual('2.10', c_idna.version)
-        self.assertEqual('pkg:conda/idna@2.10?build=pyhd3eb1b0_0&channel=pkgs/main&subdir=noarch',
-                         c_idna.purl.to_string())
-        self.assertEqual(1, len(c_idna.external_references), f'{c_idna.external_references}')
-        self.assertEqual(0, len(c_idna.external_references.pop().hashes))
-        self.assertEqual(0, len(c_idna.hashes), f'{c_idna.hashes}')
-
-    def test_conda_list_json_mixed(self) -> None:
-        # conda environment which has both conda and pypi packages
-        # see https://github.com/CycloneDX/cyclonedx-python/issues/462
-        conda_list_output_file = os.path.join(os.path.dirname(__file__),
-                                              'fixtures/conda-list-issue462.json')
-
-        with (open(conda_list_output_file, 'r')) as conda_list_output_fh:
-            parser = CondaListJsonParser(conda_data=conda_list_output_fh.read())
-
-        self.assertEqual(25, parser.component_count())
-        components = parser.get_components()
-
-        c_libffi = next(filter(lambda c: c.name == 'libffi', components), None)
-        self.assertIsNotNone(c_libffi)
-        self.assertEqual('libffi', c_libffi.name)
-        self.assertEqual('3.4.2', c_libffi.version)
-        self.assertEqual('pkg:conda/libffi@3.4.2?build=h6a678d5_6&channel=pkgs/main&subdir=linux-64',
-                         c_libffi.purl.to_string())
-
-        c_seawater = next(filter(lambda c: c.name == 'seawater', components), None)
-        self.assertIsNotNone(c_seawater)
-        self.assertEqual('seawater', c_seawater.name)
-        self.assertEqual('3.3.4', c_seawater.version)
-        self.assertEqual('pkg:pypi/seawater@3.3.4',
-                         c_seawater.purl.to_string())
-
-    def test_conda_list_json_use_purl_bom_ref(self) -> None:
-        conda_list_output_file = os.path.join(os.path.dirname(__file__),
-                                              'fixtures/conda-list-output.json')
-
-        with (open(conda_list_output_file, 'r')) as conda_list_output_fh:
-            parser = CondaListJsonParser(conda_data=conda_list_output_fh.read(),
-                                         use_purl_bom_ref=True)
-
-        self.assertEqual(34, parser.component_count())
-        components = parser.get_components()
-
-        c_idna = next(filter(lambda c: c.name == 'idna', components), None)
-        self.assertIsNotNone(c_idna)
-        self.assertEqual('idna', c_idna.name)
-        self.assertEqual(c_idna.purl.to_string(), c_idna.bom_ref.value)
-        self.assertEqual('2.10', c_idna.version)
-        self.assertEqual('pkg:conda/idna@2.10?build=pyhd3eb1b0_0&channel=pkgs/main&subdir=noarch',
-                         c_idna.purl.to_string())
-        self.assertEqual(1, len(c_idna.external_references), f'{c_idna.external_references}')
-        self.assertEqual(0, len(c_idna.external_references.pop().hashes))
-        self.assertEqual(0, len(c_idna.hashes), f'{c_idna.hashes}')
-
-    def test_conda_list_explicit_md5(self) -> None:
-        conda_list_output_file = os.path.join(os.path.dirname(__file__),
-                                              'fixtures/conda-list-explicit-md5.txt')
-
-        with (open(conda_list_output_file, 'r')) as conda_list_output_fh:
-            parser = CondaListExplicitParser(conda_data=conda_list_output_fh.read())
-
-        self.assertEqual(34, parser.component_count())
-        components = parser.get_components()
-
-        c_idna = next(filter(lambda c: c.name == 'idna', components), None)
-        self.assertIsNotNone(c_idna)
-        self.assertEqual('idna', c_idna.name)
-        self.assertEqual('2.10', c_idna.version)
-        self.assertEqual('pkg:conda/idna@2.10?build=pyhd3eb1b0_0&channel=pkgs/main&subdir=noarch&type=tar.bz2',
-                         c_idna.purl.to_string())
-        self.assertEqual(1, len(c_idna.external_references), f'{c_idna.external_references}')
-        self.assertEqual(0, len(c_idna.external_references.pop().hashes))
-        self.assertEqual(1, len(c_idna.hashes), f'{c_idna.hashes}')
-        hash: HashType = c_idna.hashes.pop()
-        self.assertEqual(HashAlgorithm.MD5, hash.alg)
-        self.assertEqual('153ff132f593ea80aae2eea61a629c92', hash.content)
-
-    def test_conda_list_build_number_text(self) -> None:
-        conda_list_output_file = os.path.join(os.path.dirname(__file__), 'fixtures/conda-list-build-number-text.txt')
-
-        with (open(conda_list_output_file, 'r')) as conda_list_output_fh:
-            parser = CondaListExplicitParser(conda_data=conda_list_output_fh.read())
-
-        self.assertEqual(39, parser.component_count())
-        components = parser.get_components()
-
-        c_libgcc_mutex = next(filter(lambda c: c.name == '_libgcc_mutex', components), None)
-        self.assertIsNotNone(c_libgcc_mutex)
-        self.assertEqual('_libgcc_mutex', c_libgcc_mutex.name)
-        self.assertEqual('0.1', c_libgcc_mutex.version)
-        self.assertEqual('pkg:conda/_libgcc_mutex@0.1?build=main&channel=pkgs/main&subdir=linux-64&type=conda',
-                         c_libgcc_mutex.purl.to_string())
-        self.assertEqual(0, len(c_libgcc_mutex.hashes), f'{c_libgcc_mutex.hashes}')
-
-        c_pycparser = next(filter(lambda c: c.name == 'pycparser', components), None)
-        self.assertIsNotNone(c_pycparser)
-        self.assertEqual('pycparser', c_pycparser.name)
-        self.assertEqual('2.21', c_pycparser.version)
-        self.assertEqual('pkg:conda/pycparser@2.21?build=pyhd3eb1b0_0&channel=pkgs/main&subdir=noarch&type=conda',
-                         c_pycparser.purl.to_string())
-        self.assertEqual(0, len(c_pycparser.hashes), f'{c_pycparser.hashes}')
-
-        c_openmp_mutex = next(filter(lambda c: c.name == '_openmp_mutex', components), None)
-        self.assertIsNotNone(c_openmp_mutex)
-        self.assertEqual('_openmp_mutex', c_openmp_mutex.name)
-        self.assertEqual('4.5', c_openmp_mutex.version)
-        self.assertEqual('pkg:conda/_openmp_mutex@4.5?build=1_gnu&channel=pkgs/main&subdir=linux-64&type=tar.bz2',
-                         c_openmp_mutex.purl.to_string())
-        self.assertEqual(0, len(c_openmp_mutex.hashes), f'{c_openmp_mutex.hashes}')
-
-    def test_conda_list_malformed(self) -> None:
-        conda_list_output_file = os.path.join(os.path.dirname(__file__), 'fixtures/conda-list-broken.txt')
-
-        with (open(conda_list_output_file, 'r')) as conda_list_output_fh:
-            with self.assertRaisesRegex(ValueError, re.compile(r'^unexpected format', re.IGNORECASE)):
-                CondaListExplicitParser(conda_data=conda_list_output_fh.read())
diff --git a/tests/test_parser_environment.py b/tests/test_parser_environment.py
deleted file mode 100644
index 53b1fbe5..00000000
--- a/tests/test_parser_environment.py
+++ /dev/null
@@ -1,63 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-from unittest import TestCase
-
-from cyclonedx.model.license import DisjunctiveLicense
-
-from cyclonedx_py._internal.parser.environment import EnvironmentParser
-
-
-class TestEnvironmentParser(TestCase):
-
-    def test_simple(self) -> None:
-        """
-        @todo This test is a vague as it will detect the unique environment where tests are being executed -
-                so is this valid?
-
-        :return:
-        """
-        parser = EnvironmentParser()
-        self.assertGreater(parser.component_count(), 1)
-
-        # We can only be sure that tox is in the environment, for example as we use tox to run tests
-        c_tox = next(filter(lambda c: c.name == 'tox', parser.get_components()), None)
-        self.assertIsNotNone(c_tox)
-        self.assertNotEqual(c_tox.purl.to_string(), c_tox.bom_ref.value)
-        self.assertIsNotNone(c_tox.licenses)
-        self.assertEqual(len(c_tox.licenses), 1)
-        self.assertEqual({DisjunctiveLicense(id="MIT")}, c_tox.licenses)
-
-    def test_simple_use_purl_bom_ref(self) -> None:
-        """
-        @todo This test is a vague as it will detect the unique environment where tests are being executed -
-                so is this valid?
-
-        :return:
-        """
-        parser = EnvironmentParser(use_purl_bom_ref=True)
-        self.assertGreater(parser.component_count(), 1)
-
-        # We can only be sure that tox is in the environment, for example as we use tox to run tests
-        c_tox = next(filter(lambda c: c.name == 'tox', parser.get_components()), None)
-        self.assertIsNotNone(c_tox)
-        self.assertEqual(c_tox.purl.to_string(), c_tox.bom_ref.value)
-        self.assertIsNotNone(c_tox.licenses)
-        self.assertEqual(len(c_tox.licenses), 1)
-        self.assertEqual({DisjunctiveLicense(id="MIT")}, c_tox.licenses)
diff --git a/tests/test_parser_pipenv.py b/tests/test_parser_pipenv.py
deleted file mode 100644
index ef907d10..00000000
--- a/tests/test_parser_pipenv.py
+++ /dev/null
@@ -1,120 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import os
-from unittest import TestCase
-
-from cyclonedx_py._internal.parser.pipenv import PipEnvFileParser
-
-
-class TestPipEnvParser(TestCase):
-
-    def test_simple(self) -> None:
-        tests_pipfile_lock = os.path.join(os.path.dirname(__file__), 'fixtures/pipfile-lock-simple.txt')
-
-        parser = PipEnvFileParser(pipenv_lock_filename=tests_pipfile_lock)
-        self.assertEqual(2, parser.component_count())
-
-        c_toml = next(filter(lambda c: c.name == 'toml', parser.get_components()), None)
-        self.assertIsNotNone(c_toml)
-        self.assertEqual('toml', c_toml.name)
-        self.assertNotEqual(c_toml.purl.to_string(), c_toml.bom_ref.value)
-        self.assertEqual('0.10.2', c_toml.version)
-        self.assertEqual(2, len(c_toml.external_references), f'{c_toml.external_references}')
-        self.assertEqual(1, len(c_toml.external_references.pop().hashes))
-        c_property = next(filter(lambda p: p.name == 'cdx:pipenv:package:category', c_toml.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('default', c_property.value)
-
-        c_flake8 = next(filter(lambda c: c.name == 'flake8', parser.get_components()), None)
-        self.assertIsNotNone(c_flake8)
-        self.assertEqual('flake8', c_flake8.name)
-        self.assertNotEqual(c_flake8.purl.to_string(), c_flake8.bom_ref.value)
-        self.assertEqual('3.7.9', c_flake8.version)
-        self.assertEqual(2, len(c_flake8.external_references), f'{c_flake8.external_references}')
-        self.assertEqual(1, len(c_flake8.external_references.pop().hashes))
-        c_property = next(filter(lambda p: p.name == 'cdx:pipenv:package:category', c_flake8.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('develop', c_property.value)
-
-    def test_simple_use_purl_bom_ref(self) -> None:
-        tests_pipfile_lock = os.path.join(os.path.dirname(__file__), 'fixtures/pipfile-lock-simple.txt')
-
-        parser = PipEnvFileParser(pipenv_lock_filename=tests_pipfile_lock,
-                                  use_purl_bom_ref=True)
-        self.assertEqual(2, parser.component_count())
-
-        c_toml = next(filter(lambda c: c.name == 'toml', parser.get_components()), None)
-        self.assertIsNotNone(c_toml)
-        self.assertEqual('toml', c_toml.name)
-        self.assertEqual(c_toml.purl.to_string(), c_toml.bom_ref.value)
-        self.assertEqual('0.10.2', c_toml.version)
-        self.assertEqual(2, len(c_toml.external_references), f'{c_toml.external_references}')
-        self.assertEqual(1, len(c_toml.external_references.pop().hashes))
-        c_property = next(filter(lambda p: p.name == 'cdx:pipenv:package:category', c_toml.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('default', c_property.value)
-
-        c_flake8 = next(filter(lambda c: c.name == 'flake8', parser.get_components()), None)
-        self.assertIsNotNone(c_flake8)
-        self.assertEqual('flake8', c_flake8.name)
-        self.assertEqual(c_flake8.purl.to_string(), c_flake8.bom_ref.value)
-        self.assertEqual('3.7.9', c_flake8.version)
-        self.assertEqual(2, len(c_flake8.external_references), f'{c_flake8.external_references}')
-        self.assertEqual(1, len(c_flake8.external_references.pop().hashes))
-        c_property = next(filter(lambda p: p.name == 'cdx:pipenv:package:category', c_flake8.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('develop', c_property.value)
-
-    def test_with_multiple_and_no_index(self) -> None:
-        tests_pipfile_lock = os.path.join(os.path.dirname(__file__), 'fixtures/pipfile-lock-no-index-example.txt')
-
-        parser = PipEnvFileParser(pipenv_lock_filename=tests_pipfile_lock)
-        self.assertEqual(3, parser.component_count())
-
-        c_anyio = next(filter(lambda c: c.name == 'anyio', parser.get_components()), None)
-        self.assertIsNotNone(c_anyio)
-        self.assertEqual('anyio', c_anyio.name)
-        self.assertEqual('3.3.3', c_anyio.version)
-        self.assertEqual(2, len(c_anyio.external_references), f'{c_anyio.external_references}')
-        self.assertEqual(1, len(c_anyio.external_references.pop().hashes))
-        c_property = next(filter(lambda p: p.name == 'cdx:pipenv:package:category', c_anyio.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('default', c_property.value)
-
-        c_toml = next(filter(lambda c: c.name == 'toml', parser.get_components()), None)
-        self.assertIsNotNone(c_toml)
-        self.assertEqual('toml', c_toml.name)
-        self.assertEqual('0.10.2', c_toml.version)
-        self.assertEqual(2, len(c_toml.external_references), f'{c_toml.external_references}')
-        self.assertEqual(1, len(c_toml.external_references.pop().hashes))
-        c_property = next(filter(lambda p: p.name == 'cdx:pipenv:package:category', c_toml.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('default', c_property.value)
-
-        c_flake8 = next(filter(lambda c: c.name == 'flake8', parser.get_components()), None)
-        self.assertIsNotNone(c_flake8)
-        self.assertEqual('flake8', c_flake8.name)
-        self.assertNotEqual(c_flake8.purl.to_string(), c_flake8.bom_ref.value)
-        self.assertEqual('3.7.9', c_flake8.version)
-        self.assertEqual(2, len(c_flake8.external_references), f'{c_flake8.external_references}')
-        self.assertEqual(1, len(c_flake8.external_references.pop().hashes))
-        c_property = next(filter(lambda p: p.name == 'cdx:pipenv:package:category', c_flake8.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('develop', c_property.value)
diff --git a/tests/test_parser_poetry.py b/tests/test_parser_poetry.py
deleted file mode 100644
index 8b137d94..00000000
--- a/tests/test_parser_poetry.py
+++ /dev/null
@@ -1,86 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import os
-from unittest import TestCase
-
-from ddt import data, ddt
-
-from cyclonedx_py._internal.parser.poetry import PoetryFileParser
-
-
-@ddt
-class TestPoetryParser(TestCase):
-
-    @data('poetry-lock11-simple.txt',
-          'poetry-lock20-simple.txt')
-    def test_simple(self, lock_file_name: str) -> None:
-        poetry_lock_filename = os.path.join(os.path.dirname(__file__), 'fixtures', lock_file_name)
-        parser = PoetryFileParser(poetry_lock_filename=poetry_lock_filename)
-        self.assertEqual(2, parser.component_count())
-
-        component = next(filter(lambda c: c.name == 'toml', parser.get_components()), None)
-        self.assertIsNotNone(component)
-        self.assertEqual('toml', component.name)
-        self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-        self.assertEqual('0.10.2', component.version)
-        self.assertEqual(2, len(component.external_references), f'{component.external_references}')
-        c_property = next(filter(lambda p: p.name == 'cdx:poetry:package:group', component.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('main', c_property.value)
-
-        component = next(filter(lambda c: c.name == 'ddt', parser.get_components()), None)
-        self.assertIsNotNone(component)
-        self.assertEqual('ddt', component.name)
-        self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-        self.assertEqual('1.6.0', component.version)
-        self.assertEqual(2, len(component.external_references), f'{component.external_references}')
-        self.assertEqual(1, len(component.properties))
-        c_property = next(filter(lambda p: p.name == 'cdx:poetry:package:group', component.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('dev', c_property.value)
-
-    @data('poetry-lock11-simple.txt',
-          'poetry-lock20-simple.txt')
-    def test_simple_purl_bom_ref(self, lock_file_name: str) -> None:
-        poetry_lock_filename = os.path.join(os.path.dirname(__file__), 'fixtures', lock_file_name)
-        parser = PoetryFileParser(poetry_lock_filename=poetry_lock_filename,
-                                  use_purl_bom_ref=True)
-        self.assertEqual(2, parser.component_count())
-
-        component = next(filter(lambda c: c.name == 'toml', parser.get_components()), None)
-        self.assertIsNotNone(component)
-        self.assertEqual('toml', component.name)
-        self.assertEqual(component.purl.to_string(), component.bom_ref.value)
-        self.assertEqual('0.10.2', component.version)
-        self.assertEqual(2, len(component.external_references), f'{component.external_references}')
-        c_property = next(filter(lambda p: p.name == 'cdx:poetry:package:group', component.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('main', c_property.value)
-
-        component = next(filter(lambda c: c.name == 'ddt', parser.get_components()), None)
-        self.assertIsNotNone(component)
-        self.assertEqual('ddt', component.name)
-        self.assertEqual(component.purl.to_string(), component.bom_ref.value)
-        self.assertEqual('1.6.0', component.version)
-        self.assertEqual(2, len(component.external_references), f'{component.external_references}')
-        self.assertEqual(1, len(component.properties))
-        c_property = next(filter(lambda p: p.name == 'cdx:poetry:package:group', component.properties), None)
-        self.assertIsNotNone(c_property)
-        self.assertEqual('dev', c_property.value)
diff --git a/tests/test_parser_requirements.py b/tests/test_parser_requirements.py
deleted file mode 100644
index 90ff4d0c..00000000
--- a/tests/test_parser_requirements.py
+++ /dev/null
@@ -1,188 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-import os
-from unittest import TestCase
-
-from cyclonedx.model import HashAlgorithm, HashType
-from cyclonedx.model.component import Component
-
-from cyclonedx_py._internal.parser.requirements import RequirementsFileParser, RequirementsParser
-
-
-class TestRequirementsParser(TestCase):
-
-    def test_simple(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-simple.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(1, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_simple_use_purl_bom_ref(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-simple.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read(),
-                use_purl_bom_ref=True
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(1, len(components), f'{components}')
-        for component in components:
-            self.assertEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_example_1(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-example-1.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(3, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_example_with_comments(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-with-comments.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(5, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_example_multilines_with_comments(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-multilines-with-comments.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(1, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-        c0: Component = components[0]
-        self.assertEqual(1, len(c0.hashes))
-        hash: HashType = c0.hashes.pop()
-        self.assertEqual(HashAlgorithm.SHA_256, hash.alg)
-        self.assertNotEqual(0, len(hash.content), f'{hash.content}')
-
-    def test_example_local_packages(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-local-and-remote-packages.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(6, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_example_local_and_nested_packages(self) -> None:
-        # RequirementsFileParser can parse nested requirements files,
-        # but RequirementsParser cannot.
-        parser = RequirementsFileParser(
-            requirements_file=os.path.join(os.path.dirname(__file__),
-                                           'fixtures/requirements-local-and-remote-packages.txt')
-        )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(7, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_example_private_packages(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-private-packages.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(1, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_example_with_urls(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-with-urls.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(4, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-    def test_example_with_hashes(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-with-hashes.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertFalse(parser.has_warnings(), f'{parser.get_warnings()}')
-        self.assertEqual(5, len(components), f'{components}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
-
-        c_idna = next(filter(lambda c: c.name == 'idna', components), None)
-        self.assertIsNotNone(c_idna)
-        self.assertEqual('idna', c_idna.name)
-        self.assertEqual(2, len(c_idna.hashes), f'{c_idna.hashes}')
-        hash: HashType = c_idna.hashes.pop()
-        self.assertEqual(HashAlgorithm.SHA_256, hash.alg)
-        self.assertNotEqual(0, len(hash.content), f'{hash.content}')
-
-    def test_example_without_pinned_versions_warns(self) -> None:
-        with open(os.path.join(os.path.dirname(__file__),
-                               'fixtures/requirements-without-pinned-versions.txt')) as r:
-            parser = RequirementsParser(
-                requirements_content=r.read()
-            )
-        components = parser.get_components()
-
-        self.assertEqual(2, len(components), f'{components}')
-        self.assertTrue(parser.has_warnings(), f'{parser.get_warnings()}')
-        for component in components:
-            self.assertNotEqual(component.purl.to_string(), component.bom_ref.value)
diff --git a/tests/test_utils_conda.py b/tests/test_utils_conda.py
deleted file mode 100644
index bbeba882..00000000
--- a/tests/test_utils_conda.py
+++ /dev/null
@@ -1,187 +0,0 @@
-# encoding: utf-8
-
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-from unittest import TestCase
-
-from cyclonedx_py._internal.utils.conda import (
-    CondaPackage,
-    parse_conda_json_to_conda_package,
-    parse_conda_list_str_to_conda_package,
-)
-
-
-class TestUtilsConda(TestCase):
-
-    def test_parse_conda_json_no_hash(self) -> None:
-        cp: CondaPackage = parse_conda_json_to_conda_package(
-            conda_json_str='{"base_url": "https://repo.anaconda.com/pkgs/main","build_number": 1003,"build_string": '
-                           '"py39hecd8cb5_1003","channel": "pkgs/main","dist_name": "chardet-4.0.0-py39hecd8cb5_1003",'
-                           '"name": "chardet","platform": "osx-64","version": "4.0.0"}'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(1003, cp['build_number'])
-        self.assertEqual('py39hecd8cb5_1003', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('chardet-4.0.0-py39hecd8cb5_1003', cp['dist_name'])
-        self.assertEqual('chardet', cp['name'])
-        self.assertEqual('osx-64', cp['platform'])
-        self.assertEqual('4.0.0', cp['version'])
-        self.assertIsNone(cp['md5_hash'])
-
-    def test_parse_conda_list_str_no_hash(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://repo.anaconda.com/pkgs/main/osx-64/chardet-4.0.0-py39hecd8cb5_1003.conda'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(1003, cp['build_number'])
-        self.assertEqual('py39hecd8cb5_1003', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('chardet-4.0.0-py39hecd8cb5_1003', cp['dist_name'])
-        self.assertEqual('chardet', cp['name'])
-        self.assertEqual('osx-64', cp['platform'])
-        self.assertEqual('4.0.0', cp['version'])
-        self.assertEqual('conda', cp['package_format'])
-        self.assertIsNone(cp['md5_hash'])
-
-    def test_parse_conda_list_str_with_hash_1(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://repo.anaconda.com/pkgs/main/noarch/tzdata-2021a-h52ac0ba_0.conda'
-                           '#d42e4db918af84a470286e4c300604a3'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(0, cp['build_number'])
-        self.assertEqual('h52ac0ba_0', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('tzdata-2021a-h52ac0ba_0', cp['dist_name'])
-        self.assertEqual('tzdata', cp['name'])
-        self.assertEqual('noarch', cp['platform'])
-        self.assertEqual('2021a', cp['version'], )
-        self.assertEqual('conda', cp['package_format'])
-        self.assertEqual('d42e4db918af84a470286e4c300604a3', cp['md5_hash'])
-
-    def test_parse_conda_list_str_with_hash_2(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://repo.anaconda.com/pkgs/main/osx-64/ca-certificates-2021.7.5-hecd8cb5_1.conda'
-                           '#c2d0ae65c08dacdcf86770b7b5bbb187'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(1, cp['build_number'])
-        self.assertEqual('hecd8cb5_1', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('ca-certificates-2021.7.5-hecd8cb5_1', cp['dist_name'])
-        self.assertEqual('ca-certificates', cp['name'])
-        self.assertEqual('osx-64', cp['platform'])
-        self.assertEqual('2021.7.5', cp['version'], )
-        self.assertEqual('conda', cp['package_format'])
-        self.assertEqual('c2d0ae65c08dacdcf86770b7b5bbb187', cp['md5_hash'])
-
-    def test_parse_conda_list_str_with_hash_3(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://repo.anaconda.com/pkgs/main/noarch/idna-2.10-pyhd3eb1b0_0.tar.bz2'
-                           '#153ff132f593ea80aae2eea61a629c92'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(0, cp['build_number'])
-        self.assertEqual('pyhd3eb1b0_0', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('idna-2.10-pyhd3eb1b0_0', cp['dist_name'])
-        self.assertEqual('idna', cp['name'])
-        self.assertEqual('noarch', cp['platform'])
-        self.assertEqual('2.10', cp['version'], )
-        self.assertEqual('tar.bz2', cp['package_format'])
-        self.assertEqual('153ff132f593ea80aae2eea61a629c92', cp['md5_hash'])
-
-    def test_parse_conda_list_str_with_hash_4(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://conda.anaconda.org/conda-forge/linux-64/_libgcc_mutex-0.1-conda_forge.tar.bz2'
-                           '#d7c89558ba9fa0495403155b64376d81'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://conda.anaconda.org/conda-forge', cp['base_url'])
-        self.assertIsNone(cp['build_number'])
-        self.assertEqual('conda_forge', cp['build_string'])
-        self.assertEqual('conda-forge', cp['channel'])
-        self.assertEqual('_libgcc_mutex-0.1-conda_forge', cp['dist_name'])
-        self.assertEqual('_libgcc_mutex', cp['name'])
-        self.assertEqual('linux-64', cp['platform'])
-        self.assertEqual('0.1', cp['version'])
-        self.assertEqual('tar.bz2', cp['package_format'])
-        self.assertEqual('d7c89558ba9fa0495403155b64376d81', cp['md5_hash'])
-
-    def test_parse_conda_list_build_number(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://repo.anaconda.com/pkgs/main/osx-64/chardet-4.0.0-py39hecd8cb5_1003.conda'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(1003, cp['build_number'])
-        self.assertEqual('py39hecd8cb5_1003', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('chardet-4.0.0-py39hecd8cb5_1003', cp['dist_name'])
-        self.assertEqual('chardet', cp['name'])
-        self.assertEqual('osx-64', cp['platform'])
-        self.assertEqual('4.0.0', cp['version'])
-        self.assertEqual('conda', cp['package_format'])
-        self.assertIsNone(cp['md5_hash'])
-
-    def test_parse_conda_list_no_build_number(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://repo.anaconda.com/pkgs/main/linux-64/_libgcc_mutex-0.1-main.conda'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(None, cp['build_number'])
-        self.assertEqual('main', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('_libgcc_mutex-0.1-main', cp['dist_name'])
-        self.assertEqual('_libgcc_mutex', cp['name'])
-        self.assertEqual('linux-64', cp['platform'])
-        self.assertEqual('0.1', cp['version'])
-        self.assertEqual('conda', cp['package_format'])
-        self.assertIsNone(cp['md5_hash'])
-
-    def test_parse_conda_list_no_build_number2(self) -> None:
-        cp: CondaPackage = parse_conda_list_str_to_conda_package(
-            conda_list_str='https://repo.anaconda.com/pkgs/main/linux-64/_openmp_mutex-4.5-1_gnu.tar.bz2'
-        )
-
-        self.assertIsInstance(cp, dict)
-        self.assertEqual('https://repo.anaconda.com/pkgs/main', cp['base_url'])
-        self.assertEqual(None, cp['build_number'])
-        self.assertEqual('1_gnu', cp['build_string'])
-        self.assertEqual('pkgs/main', cp['channel'])
-        self.assertEqual('_openmp_mutex-4.5-1_gnu', cp['dist_name'])
-        self.assertEqual('_openmp_mutex', cp['name'])
-        self.assertEqual('linux-64', cp['platform'])
-        self.assertEqual('4.5', cp['version'])
-        self.assertEqual('tar.bz2', cp['package_format'])
-        self.assertIsNone(cp['md5_hash'])

From ef2b75fb553ff000be334760ba052f3b22f9740c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 27 Oct 2023 01:54:22 +0200
Subject: [PATCH 002/155] research cli

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/__init__.py           |   2 -
 cyclonedx_py/__main__.py           |  19 ++++++
 cyclonedx_py/_internal/__init__.py |  21 ++++++
 cyclonedx_py/_internal/cli.py      | 101 +++++++++++++++++++++++++++++
 4 files changed, 141 insertions(+), 2 deletions(-)
 create mode 100644 cyclonedx_py/__main__.py
 create mode 100644 cyclonedx_py/_internal/__init__.py
 create mode 100644 cyclonedx_py/_internal/cli.py

diff --git a/cyclonedx_py/__init__.py b/cyclonedx_py/__init__.py
index b582dae1..c121bc57 100644
--- a/cyclonedx_py/__init__.py
+++ b/cyclonedx_py/__init__.py
@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/cyclonedx_py/__main__.py b/cyclonedx_py/__main__.py
new file mode 100644
index 00000000..d739a849
--- /dev/null
+++ b/cyclonedx_py/__main__.py
@@ -0,0 +1,19 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+from ._internal.cli import main
+import sys
+
+sys.exit(main(prog=f'python3 -m {__package__}'))
diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
new file mode 100644
index 00000000..79162ccd
--- /dev/null
+++ b/cyclonedx_py/_internal/__init__.py
@@ -0,0 +1,21 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+"""
+This package is internal - it is not public API.
+All in here may have breaking change without notice.
+"""
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
new file mode 100644
index 00000000..6eb2b6f1
--- /dev/null
+++ b/cyclonedx_py/_internal/cli.py
@@ -0,0 +1,101 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+import argparse
+from sys import stdin, stdout, stderr
+from abc import ABC, abstractmethod
+from typing import Any, Optional, Type
+from .. import __version__
+
+
+class CS_Proto(ABC):
+    @staticmethod
+    @abstractmethod
+    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
+        ...
+
+    def __init__(self, args: argparse.Namespace) -> None:
+        self._args = args
+
+    @abstractmethod
+    def __call__(self) -> int:
+        ...
+
+
+class CS_foo(CS_Proto):
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
+        p = argparse.ArgumentParser(description='description CS_foo TODO', **kwargs)
+        p.add_argument('-i', '--infile', help='I HELP TODO', nargs='+', type=argparse.FileType('rb'), default='poetry.lock')
+        return p
+
+    def __call__(self) -> int:
+        print(self._args, file=stderr)
+        return 0
+
+
+class CS_bar(CS_Proto):
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
+        p = argparse.ArgumentParser(description='description CS_bar TODO', **kwargs)
+        p.add_argument('-i', '--infile', help='I HELP TODO', nargs='?', type=argparse.FileType('rb'), default='-')
+        return p
+
+    def __call__(self) -> int:
+        print(self._args, file=stderr)
+        return 0
+
+
+def make_cli(**kwargs: Any) -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        description='description TODO',
+        **kwargs)
+    p.add_argument('--version', action='version', version=__version__)
+    sp = p.add_subparsers(metavar='command', required=True)
+
+    op = argparse.ArgumentParser(add_help=False)
+    opg = op.add_argument_group(title='OPG TODO')
+    opg.add_argument('-o', '--outfile', help='O HELP TODO', nargs='?', type=argparse.FileType('w', encoding='utf8'), default='-')
+    BooleanOptionalAction: Optional[argparse.Action] = getattr(argparse, 'BooleanOptionalAction', None)
+    if BooleanOptionalAction:
+        opg.add_argument('--validate', help='validate HELP TODO', action=argparse.BooleanOptionalAction, default=True)
+    else:
+        vg = opg.add_mutually_exclusive_group()
+        vg.add_argument('--validate', help='validate HELP TODO', action='store_true', default=True)
+        vg.add_argument('--no-validate', help='no-validate HELP TODO', action='store_false')
+        del vg
+
+    sct: str
+    scc: Type[CS_Proto]
+    scd: str
+    for sct, scc, scd in (
+        ('foo', CS_foo, 'foo description'),
+        ('bar', CS_bar, 'bar description'),
+    ):
+        spp = scc.make_argument_parser(add_help=False)
+        sp.add_parser(sct,
+                      help=scd,
+                      description=spp.description,
+                      parents=[spp, opg]
+                      ).set_defaults(scc=scc)
+        del spp
+
+    return p
+
+
+def main(**kwargs: Any) -> int:
+    args = make_cli(**kwargs).parse_args()
+    return args.scc(args)()

From 1c00a3a514df47ee9635fdc5dec8a2eea5859adf Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 27 Oct 2023 18:28:58 +0200
Subject: [PATCH 003/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/__main__.py      |   3 +-
 cyclonedx_py/_internal/cli.py | 174 ++++++++++++++++++++++++----------
 2 files changed, 126 insertions(+), 51 deletions(-)

diff --git a/cyclonedx_py/__main__.py b/cyclonedx_py/__main__.py
index d739a849..0656ab96 100644
--- a/cyclonedx_py/__main__.py
+++ b/cyclonedx_py/__main__.py
@@ -13,7 +13,8 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
-from ._internal.cli import main
 import sys
 
+from ._internal.cli import main
+
 sys.exit(main(prog=f'python3 -m {__package__}'))
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 6eb2b6f1..49c2a6c5 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -15,13 +15,19 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 import argparse
-from sys import stdin, stdout, stderr
 from abc import ABC, abstractmethod
+from sys import stderr, stdin, stdout
 from typing import Any, Optional, Type
+
+from cyclonedx.model.bom import Bom
+from cyclonedx.output import make_outputter
+from cyclonedx.schema import OutputFormat, SchemaVersion
+from cyclonedx.validation import make_schemabased_validator
+
 from .. import __version__
 
 
-class CS_Proto(ABC):
+class CS_BomBuilder(ABC):
     @staticmethod
     @abstractmethod
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
@@ -31,71 +37,139 @@ def __init__(self, args: argparse.Namespace) -> None:
         self._args = args
 
     @abstractmethod
-    def __call__(self) -> int:
+    def __call__(self) -> Bom:
         ...
 
 
-class CS_foo(CS_Proto):
+class CS_foo(CS_BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         p = argparse.ArgumentParser(description='description CS_foo TODO', **kwargs)
-        p.add_argument('-i', '--infile', help='I HELP TODO', nargs='+', type=argparse.FileType('rb'), default='poetry.lock')
+        p.add_argument('-i', '--infile', help='I HELP TODO',
+                       type=argparse.FileType('rb'), default='poetry.lock')
         return p
 
-    def __call__(self) -> int:
-        print(self._args, file=stderr)
-        return 0
+    def __call__(self) -> Bom:
+        # print(self._args, file=stderr)
+        return Bom()
 
 
-class CS_bar(CS_Proto):
+class CS_bar(CS_BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         p = argparse.ArgumentParser(description='description CS_bar TODO', **kwargs)
-        p.add_argument('-i', '--infile', help='I HELP TODO', nargs='?', type=argparse.FileType('rb'), default='-')
+        p.add_argument('-i', '--infile', help='I HELP TODO', nargs=argparse.ONE_OR_MORE,
+                       type=argparse.FileType('rb'), default=[stdin.buffer])
         return p
 
-    def __call__(self) -> int:
-        print(self._args, file=stderr)
-        return 0
+    def __call__(self) -> Bom:
+        # print(self._args, file=stderr)
+        return Bom()
 
 
-def make_cli(**kwargs: Any) -> argparse.ArgumentParser:
-    p = argparse.ArgumentParser(
-        description='description TODO',
-        **kwargs)
-    p.add_argument('--version', action='version', version=__version__)
-    sp = p.add_subparsers(metavar='command', required=True)
-
-    op = argparse.ArgumentParser(add_help=False)
-    opg = op.add_argument_group(title='OPG TODO')
-    opg.add_argument('-o', '--outfile', help='O HELP TODO', nargs='?', type=argparse.FileType('w', encoding='utf8'), default='-')
-    BooleanOptionalAction: Optional[argparse.Action] = getattr(argparse, 'BooleanOptionalAction', None)
-    if BooleanOptionalAction:
-        opg.add_argument('--validate', help='validate HELP TODO', action=argparse.BooleanOptionalAction, default=True)
-    else:
-        vg = opg.add_mutually_exclusive_group()
-        vg.add_argument('--validate', help='validate HELP TODO', action='store_true', default=True)
-        vg.add_argument('--no-validate', help='no-validate HELP TODO', action='store_false')
-        del vg
-
-    sct: str
-    scc: Type[CS_Proto]
-    scd: str
-    for sct, scc, scd in (
-        ('foo', CS_foo, 'foo description'),
-        ('bar', CS_bar, 'bar description'),
-    ):
-        spp = scc.make_argument_parser(add_help=False)
-        sp.add_parser(sct,
-                      help=scd,
-                      description=spp.description,
-                      parents=[spp, opg]
-                      ).set_defaults(scc=scc)
-        del spp
-
-    return p
+class Command:
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
+        BooleanOptionalAction: Optional[argparse.Action] = getattr(argparse, 'BooleanOptionalAction', None)
+
+        p = argparse.ArgumentParser(
+            description='description TODO',
+            formatter_class=argparse.ArgumentDefaultsHelpFormatter,
+            **kwargs)
+        p.add_argument('--version', action='version', version=__version__)
+        sp = p.add_subparsers(metavar='command', required=True)
+
+        op = argparse.ArgumentParser(add_help=False, formatter_class=p.formatter_class)
+        op.add_argument('-o', '--outfile',
+                        help='O HELP TODO',
+                        dest='outfile',
+                        type=argparse.FileType('w', encoding='utf8'),
+                        default='-')
+        op.add_argument('--schema-version',
+                        dest='schemaVersion',
+                        metavar='SCHEMA_VERSION',
+                        choices=sorted((v.to_version() for v in SchemaVersion), reverse=True),
+                        type=SchemaVersion.from_version,
+                        default=SchemaVersion.V1_4.to_version())
+        op.add_argument('--output-format',
+                        dest='outputFormat',
+                        metavar='OUTPUT_FORMAT',
+                        choices=sorted(f.name for f in OutputFormat),
+                        type=lambda v: OutputFormat[v.upper()],
+                        default=OutputFormat.JSON.name)
+        if BooleanOptionalAction:
+            op.add_argument('--validate',
+                            help='validate HELP TODO',
+                            dest='validate',
+                            action=argparse.BooleanOptionalAction,
+                            default=True)
+        else:
+            vg = op.add_mutually_exclusive_group()
+            vg.add_argument('--validate',
+                            help='validate HELP TODO',
+                            dest='validate',
+                            action='store_true',
+                            default=True)
+            vg.add_argument('--no-validate',
+                            help='no-validate HELP TODO',
+                            dest='validate',
+                            action='store_false')
+            del vg
+
+        sct: str
+        scc: Type[CS_BomBuilder]
+        scd: str
+        for sct, scc, scd in (
+            ('foo', CS_foo, 'foo description'),
+            ('bar', CS_bar, 'bar description'),
+        ):
+            spp = scc.make_argument_parser(add_help=False, formatter_class=p.formatter_class)
+            sp.add_parser(sct,
+                          help=scd,
+                          description=spp.description,
+                          parents=[spp, op],
+                          formatter_class=p.formatter_class
+                          ).set_defaults(bbc=scc)
+            del sct, scc, scd
+
+        return p
+
+    def __init__(self, args: argparse.Namespace) -> None:
+        self._args = args
+
+    def __call__(self) -> int:
+        print('generating bom...', file=stderr)
+        try:
+            bom = self._args.bbc(self._args)()
+        except Exception as error:
+            print('Unexpected Error:', error, file=stderr)
+            return 1
+        print('generating bom result...', file=stderr)
+        try:
+            outputter = make_outputter(bom, self._args.outputFormat, self._args.schemaVersion)
+            output = outputter.output_as_string(indent=2)
+        except Exception as error:
+            print('Output Errors:', error, file=stderr)
+            return 1
+        if self._args.validate:
+            print('validating bom result...', file=stderr)
+            validation_error = make_schemabased_validator(
+                outputter.output_format,
+                outputter.schema_version
+            ).validate_str(output)
+            if validation_error is not None:
+                print('Validation Errors:', validation_error.data, file=stderr)
+                return 2
+            print('bom result valid.', file=stderr)
+        else:
+            print('skipped validation.', file=stderr)
+        print('writing to', self._args.outfile.name, file=stderr)
+        written = self._args.outfile.write(output)
+        self._args.outfile.close()
+        # start with a line break, to finalize possibly unterminated output.
+        print('\nwrote', written, 'bytes to', self._args.outfile.name, file=stderr)
+        return 0
 
 
 def main(**kwargs: Any) -> int:
-    args = make_cli(**kwargs).parse_args()
-    return args.scc(args)()
+    return Command(Command.make_argument_parser(**kwargs).parse_args())()

From bba3c4c48d92980bdf60615533e38827b0607283 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 27 Oct 2023 19:26:26 +0200
Subject: [PATCH 004/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 50 ++++++++++++++++++++++-------------
 1 file changed, 32 insertions(+), 18 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 49c2a6c5..9597cc8c 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -59,7 +59,7 @@ class CS_bar(CS_BomBuilder):
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         p = argparse.ArgumentParser(description='description CS_bar TODO', **kwargs)
         p.add_argument('-i', '--infile', help='I HELP TODO', nargs=argparse.ONE_OR_MORE,
-                       type=argparse.FileType('rb'), default=[stdin.buffer])
+                       type=argparse.FileType('rb'), default='-')
         return p
 
     def __call__(self) -> Bom:
@@ -72,30 +72,41 @@ class Command:
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         BooleanOptionalAction: Optional[argparse.Action] = getattr(argparse, 'BooleanOptionalAction', None)
 
+        def mk_OutputFormatCI(value: str) -> OutputFormat:
+            try:
+                return OutputFormat[value.upper()]
+            except KeyError:
+                raise argparse.ArgumentTypeError(f'unsupported value {value!r}')
+
         p = argparse.ArgumentParser(
             description='description TODO',
             formatter_class=argparse.ArgumentDefaultsHelpFormatter,
+            allow_abbrev=False,
             **kwargs)
         p.add_argument('--version', action='version', version=__version__)
         sp = p.add_subparsers(metavar='command', required=True)
 
-        op = argparse.ArgumentParser(add_help=False, formatter_class=p.formatter_class)
+        op = argparse.ArgumentParser(add_help=False)
         op.add_argument('-o', '--outfile',
                         help='O HELP TODO',
                         dest='outfile',
                         type=argparse.FileType('w', encoding='utf8'),
                         default='-')
         op.add_argument('--schema-version',
+                        help='SV TODO'
+                             f'\n{{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}',
+                        metavar='',
                         dest='schemaVersion',
-                        metavar='SCHEMA_VERSION',
-                        choices=sorted((v.to_version() for v in SchemaVersion), reverse=True),
+                        choices=SchemaVersion,
                         type=SchemaVersion.from_version,
                         default=SchemaVersion.V1_4.to_version())
         op.add_argument('--output-format',
+                        help='OF TODO'
+                             f'\n{{choice: {", ".join(sorted(f.name for f in OutputFormat))}}}',
+                        metavar='FORMAT',
                         dest='outputFormat',
-                        metavar='OUTPUT_FORMAT',
-                        choices=sorted(f.name for f in OutputFormat),
-                        type=lambda v: OutputFormat[v.upper()],
+                        choices=OutputFormat,
+                        type=mk_OutputFormatCI,
                         default=OutputFormat.JSON.name)
         if BooleanOptionalAction:
             op.add_argument('--validate',
@@ -123,12 +134,13 @@ def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
             ('foo', CS_foo, 'foo description'),
             ('bar', CS_bar, 'bar description'),
         ):
-            spp = scc.make_argument_parser(add_help=False, formatter_class=p.formatter_class)
+            spp = scc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
                           help=scd,
                           description=spp.description,
                           parents=[spp, op],
-                          formatter_class=p.formatter_class
+                          formatter_class=p.formatter_class,
+                          allow_abbrev=p.allow_abbrev,
                           ).set_defaults(bbc=scc)
             del sct, scc, scd
 
@@ -138,21 +150,23 @@ def __init__(self, args: argparse.Namespace) -> None:
         self._args = args
 
     def __call__(self) -> int:
-        print('generating bom...', file=stderr)
+        print('DEBUG: args =', self._args, file=stderr)
+        print('Generating SBOM ...', file=stderr)
         try:
             bom = self._args.bbc(self._args)()
+        # TODO: expected error handling ...
         except Exception as error:
-            print('Unexpected Error:', error, file=stderr)
+            print(f'{error.__class__.__qualname__}:', error, file=stderr)
             return 1
-        print('generating bom result...', file=stderr)
+        print(f'Serializing SBOM: {self._args.schemaVersion.to_version()}/{self._args.outputFormat.name}', file=stderr)
         try:
             outputter = make_outputter(bom, self._args.outputFormat, self._args.schemaVersion)
             output = outputter.output_as_string(indent=2)
         except Exception as error:
-            print('Output Errors:', error, file=stderr)
+            print('Serialization Errors:', error, file=stderr)
             return 1
         if self._args.validate:
-            print('validating bom result...', file=stderr)
+            print('Validating ...', file=stderr)
             validation_error = make_schemabased_validator(
                 outputter.output_format,
                 outputter.schema_version
@@ -160,14 +174,14 @@ def __call__(self) -> int:
             if validation_error is not None:
                 print('Validation Errors:', validation_error.data, file=stderr)
                 return 2
-            print('bom result valid.', file=stderr)
+            print('Valid.', file=stderr)
         else:
-            print('skipped validation.', file=stderr)
-        print('writing to', self._args.outfile.name, file=stderr)
+            print('Skipped validation.', file=stderr)
+        print('Writing to:', self._args.outfile.name, file=stderr)
         written = self._args.outfile.write(output)
         self._args.outfile.close()
         # start with a line break, to finalize possibly unterminated output.
-        print('\nwrote', written, 'bytes to', self._args.outfile.name, file=stderr)
+        print('\nWrote', written, 'bytes to', self._args.outfile.name, file=stderr)
         return 0
 
 

From d75baa8d4deddfd284e6b56ba2865f5a83b3ef69 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 27 Oct 2023 19:33:43 +0200
Subject: [PATCH 005/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 9597cc8c..41337249 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -58,7 +58,7 @@ class CS_bar(CS_BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         p = argparse.ArgumentParser(description='description CS_bar TODO', **kwargs)
-        p.add_argument('-i', '--infile', help='I HELP TODO', nargs=argparse.ONE_OR_MORE,
+        p.add_argument('-i', '--infile', help='I HELP TODO.\nSet to "-" to read from STDIN.', nargs=argparse.ONE_OR_MORE,
                        type=argparse.FileType('rb'), default='-')
         return p
 
@@ -88,7 +88,7 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
 
         op = argparse.ArgumentParser(add_help=False)
         op.add_argument('-o', '--outfile',
-                        help='O HELP TODO',
+                        help='O HELP TODO.\nSet to "-" to write to STDOUT.',
                         dest='outfile',
                         type=argparse.FileType('w', encoding='utf8'),
                         default='-')

From d8b356354698980e90e50f492404b206ae03cc5c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 28 Oct 2023 01:39:47 +0200
Subject: [PATCH 006/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 79 ++++++++++++++++++++++-------------
 1 file changed, 50 insertions(+), 29 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 41337249..89b7a056 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -16,8 +16,8 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 import argparse
 from abc import ABC, abstractmethod
-from sys import stderr, stdin, stdout
-from typing import Any, Optional, Type
+from sys import stderr
+from typing import Any, BinaryIO, List, Optional, TextIO, Type, Union
 
 from cyclonedx.model.bom import Bom
 from cyclonedx.output import make_outputter
@@ -33,8 +33,9 @@ class CS_BomBuilder(ABC):
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         ...
 
-    def __init__(self, args: argparse.Namespace) -> None:
-        self._args = args
+    @abstractmethod
+    def __init__(self, **kwargs: Any) -> None:
+        ...
 
     @abstractmethod
     def __call__(self) -> Bom:
@@ -45,10 +46,18 @@ class CS_foo(CS_BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         p = argparse.ArgumentParser(description='description CS_foo TODO', **kwargs)
-        p.add_argument('-i', '--infile', help='I HELP TODO',
-                       type=argparse.FileType('rb'), default='poetry.lock')
+        p.add_argument('-i', '--infile',
+                       help='I HELP TODO',
+                       type=argparse.FileType('rb'),
+                       default='poetry.lock')
         return p
 
+    def __init__(self,
+                 infile: BinaryIO,
+                 **kwargs: Any) -> None:
+        del kwargs
+        self._infile = infile
+
     def __call__(self) -> Bom:
         # print(self._args, file=stderr)
         return Bom()
@@ -58,10 +67,19 @@ class CS_bar(CS_BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         p = argparse.ArgumentParser(description='description CS_bar TODO', **kwargs)
-        p.add_argument('-i', '--infile', help='I HELP TODO.\nSet to "-" to read from STDIN.', nargs=argparse.ONE_OR_MORE,
-                       type=argparse.FileType('rb'), default='-')
+        p.add_argument('-i', '--infile',
+                       help='I HELP TODO.\nSet to "-" to read from STDIN.',
+                       nargs=argparse.ONE_OR_MORE,
+                       type=argparse.FileType('rb'),
+                       default='-')
         return p
 
+    def __init__(self,
+                 infile: Union[List[BinaryIO], BinaryIO],
+                 **kwargs: Any) -> None:
+        del kwargs
+        self._infile = infile if isinstance(infile, list) else [infile]
+
     def __call__(self) -> Bom:
         # print(self._args, file=stderr)
         return Bom()
@@ -93,16 +111,16 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
                         type=argparse.FileType('w', encoding='utf8'),
                         default='-')
         op.add_argument('--schema-version',
-                        help='SV TODO'
-                             f'\n{{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}',
+                        help='SV TODO\n'
+                             f'{{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}',
                         metavar='',
                         dest='schemaVersion',
                         choices=SchemaVersion,
                         type=SchemaVersion.from_version,
                         default=SchemaVersion.V1_4.to_version())
         op.add_argument('--output-format',
-                        help='OF TODO'
-                             f'\n{{choice: {", ".join(sorted(f.name for f in OutputFormat))}}}',
+                        help='OF TODO\n'
+                             f'{{choice: {", ".join(sorted(f.name for f in OutputFormat))}}}',
                         metavar='FORMAT',
                         dest='outputFormat',
                         choices=OutputFormat,
@@ -125,11 +143,7 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
                             help='no-validate HELP TODO',
                             dest='validate',
                             action='store_false')
-            del vg
 
-        sct: str
-        scc: Type[CS_BomBuilder]
-        scd: str
         for sct, scc, scd in (
             ('foo', CS_foo, 'foo description'),
             ('bar', CS_bar, 'bar description'),
@@ -142,30 +156,38 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
                           formatter_class=p.formatter_class,
                           allow_abbrev=p.allow_abbrev,
                           ).set_defaults(bbc=scc)
-            del sct, scc, scd
 
         return p
 
-    def __init__(self, args: argparse.Namespace) -> None:
-        self._args = args
+    def __init__(self, *,
+                 validate: bool,
+                 outfile: TextIO,
+                 outputFormat: OutputFormat,
+                 schemaVersion: SchemaVersion,
+                 bbc: Type[CS_BomBuilder],
+                 **kwargs: Any) -> None:
+        self._outfile = outfile
+        self._outputFormat = outputFormat
+        self._schemaVersion = schemaVersion
+        self._validate = validate
+        self._bbc = bbc(**kwargs)
 
     def __call__(self) -> int:
-        print('DEBUG: args =', self._args, file=stderr)
         print('Generating SBOM ...', file=stderr)
         try:
-            bom = self._args.bbc(self._args)()
+            bom = self._bbc()
         # TODO: expected error handling ...
         except Exception as error:
             print(f'{error.__class__.__qualname__}:', error, file=stderr)
             return 1
-        print(f'Serializing SBOM: {self._args.schemaVersion.to_version()}/{self._args.outputFormat.name}', file=stderr)
+        print(f'Serializing SBOM: {self._schemaVersion.to_version()}/{self._outputFormat.name}', file=stderr)
         try:
-            outputter = make_outputter(bom, self._args.outputFormat, self._args.schemaVersion)
+            outputter = make_outputter(bom, self._outputFormat, self._schemaVersion)
             output = outputter.output_as_string(indent=2)
         except Exception as error:
             print('Serialization Errors:', error, file=stderr)
             return 1
-        if self._args.validate:
+        if self._validate:
             print('Validating ...', file=stderr)
             validation_error = make_schemabased_validator(
                 outputter.output_format,
@@ -177,13 +199,12 @@ def __call__(self) -> int:
             print('Valid.', file=stderr)
         else:
             print('Skipped validation.', file=stderr)
-        print('Writing to:', self._args.outfile.name, file=stderr)
-        written = self._args.outfile.write(output)
-        self._args.outfile.close()
+        print('Writing to:', self._outfile.name, file=stderr)
+        written = self._outfile.write(output)
         # start with a line break, to finalize possibly unterminated output.
-        print('\nWrote', written, 'bytes to', self._args.outfile.name, file=stderr)
+        print('\nWrote', written, 'bytes to', self._outfile.name, file=stderr)
         return 0
 
 
 def main(**kwargs: Any) -> int:
-    return Command(Command.make_argument_parser(**kwargs).parse_args())()
+    return Command(**vars(Command.make_argument_parser(**kwargs).parse_args()))()

From effb9c10da53c6632fbde03ba8b076e3b091bba8 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 28 Oct 2023 01:44:35 +0200
Subject: [PATCH 007/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .flake8 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.flake8 b/.flake8
index cdf555de..99bdef89 100644
--- a/.flake8
+++ b/.flake8
@@ -11,7 +11,7 @@ exclude =
 
 max-line-length = 120
 
-#max-complexity = 10
+max-complexity = 10
 
 ignore =
     # ignore `self`, `cls` markers of flake8-annotations>=2.0

From c5e5f57e09fe02c21fbb8fedb9aad05f928fbd55 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 28 Oct 2023 19:30:06 +0200
Subject: [PATCH 008/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 162 ++++++++++++++++++++++------------
 1 file changed, 104 insertions(+), 58 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 89b7a056..de8be283 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -15,9 +15,10 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 import argparse
+import logging
 from abc import ABC, abstractmethod
 from sys import stderr
-from typing import Any, BinaryIO, List, Optional, TextIO, Type, Union
+from typing import Any, BinaryIO, Dict, List, Optional, TextIO, Type, Union
 
 from cyclonedx.model.bom import Bom
 from cyclonedx.output import make_outputter
@@ -34,11 +35,13 @@ def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         ...
 
     @abstractmethod
-    def __init__(self, **kwargs: Any) -> None:
+    def __init__(self,
+                 logger: logging.Logger,
+                 **kwargs: Any) -> None:
         ...
 
     @abstractmethod
-    def __call__(self) -> Bom:
+    def __call__(self, **kwargs: Any) -> Bom:
         ...
 
 
@@ -53,13 +56,14 @@ def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         return p
 
     def __init__(self,
-                 infile: BinaryIO,
+                 logger: logging.Logger,
                  **kwargs: Any) -> None:
-        del kwargs
-        self._infile = infile
+        self._logger = logger
 
-    def __call__(self) -> Bom:
-        # print(self._args, file=stderr)
+    def __call__(self,  # type:ignore[override]
+                 infile: BinaryIO,
+                 **kwargs: Any) -> Bom:
+        self._logger.info('ogogog')
         return Bom()
 
 
@@ -75,19 +79,21 @@ def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
         return p
 
     def __init__(self,
-                 infile: Union[List[BinaryIO], BinaryIO],
+                 logger: logging.Logger,
                  **kwargs: Any) -> None:
-        del kwargs
-        self._infile = infile if isinstance(infile, list) else [infile]
+        self._logger = logger
 
-    def __call__(self) -> Bom:
-        # print(self._args, file=stderr)
+    def __call__(self,  # type:ignore[override]
+                 infile: Union[List[BinaryIO], BinaryIO],
+                 **kwargs: Any) -> Bom:
+        infile = infile if isinstance(infile, list) else [infile]
+        self._logger.info('lololol')
         return Bom()
 
 
 class Command:
     @staticmethod
-    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
+    def make_argument_parser(sco: argparse.ArgumentParser, **kwargs: Any) -> argparse.ArgumentParser:
         BooleanOptionalAction: Optional[argparse.Action] = getattr(argparse, 'BooleanOptionalAction', None)
 
         def mk_OutputFormatCI(value: str) -> OutputFormat:
@@ -114,7 +120,7 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
                         help='SV TODO\n'
                              f'{{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}',
                         metavar='',
-                        dest='schemaVersion',
+                        dest='schema_version',
                         choices=SchemaVersion,
                         type=SchemaVersion.from_version,
                         default=SchemaVersion.V1_4.to_version())
@@ -122,7 +128,7 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
                         help='OF TODO\n'
                              f'{{choice: {", ".join(sorted(f.name for f in OutputFormat))}}}',
                         metavar='FORMAT',
-                        dest='outputFormat',
+                        dest='output_format',
                         choices=OutputFormat,
                         type=mk_OutputFormatCI,
                         default=OutputFormat.JSON.name)
@@ -152,59 +158,99 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
             sp.add_parser(sct,
                           help=scd,
                           description=spp.description,
-                          parents=[spp, op],
+                          parents=[spp, op, sco],
                           formatter_class=p.formatter_class,
                           allow_abbrev=p.allow_abbrev,
                           ).set_defaults(bbc=scc)
 
         return p
 
+    __OWN_ARGS = {'outfile', 'schema_version', 'output_format', 'validate'}
+
+    @classmethod
+    def _clean_kwargs(cls, kwargs: Dict[str, Any]) -> Dict[str, Any]:
+        return {k: kwargs[k] for k in kwargs if k not in cls.__OWN_ARGS}
+
     def __init__(self, *,
+                 logger: logging.Logger,
                  validate: bool,
-                 outfile: TextIO,
-                 outputFormat: OutputFormat,
-                 schemaVersion: SchemaVersion,
+                 output_format: OutputFormat,
+                 schema_version: SchemaVersion,
                  bbc: Type[CS_BomBuilder],
                  **kwargs: Any) -> None:
-        self._outfile = outfile
-        self._outputFormat = outputFormat
-        self._schemaVersion = schemaVersion
+        self._logger = logger
+        self._output_format = output_format
+        self._schema_version = schema_version
         self._validate = validate
-        self._bbc = bbc(**kwargs)
-
-    def __call__(self) -> int:
-        print('Generating SBOM ...', file=stderr)
-        try:
-            bom = self._bbc()
-        # TODO: expected error handling ...
-        except Exception as error:
-            print(f'{error.__class__.__qualname__}:', error, file=stderr)
-            return 1
-        print(f'Serializing SBOM: {self._schemaVersion.to_version()}/{self._outputFormat.name}', file=stderr)
-        try:
-            outputter = make_outputter(bom, self._outputFormat, self._schemaVersion)
-            output = outputter.output_as_string(indent=2)
-        except Exception as error:
-            print('Serialization Errors:', error, file=stderr)
-            return 1
-        if self._validate:
-            print('Validating ...', file=stderr)
-            validation_error = make_schemabased_validator(
-                outputter.output_format,
-                outputter.schema_version
-            ).validate_str(output)
-            if validation_error is not None:
-                print('Validation Errors:', validation_error.data, file=stderr)
-                return 2
-            print('Valid.', file=stderr)
-        else:
-            print('Skipped validation.', file=stderr)
-        print('Writing to:', self._outfile.name, file=stderr)
-        written = self._outfile.write(output)
-        # start with a line break, to finalize possibly unterminated output.
-        print('\nWrote', written, 'bytes to', self._outfile.name, file=stderr)
-        return 0
+        self._bbc = bbc(logger=self._logger.getChild(bbc.__name__), **self._clean_kwargs(kwargs))
+
+    def validate(self, output: str) -> bool:
+        if not self._validate:
+            self._logger.warning('Validation skipped.')
+            return False
+        self._logger.info('Validating to schema: %s/%s', self._schema_version.to_version(), self._output_format.name)
+        validation_error = make_schemabased_validator(
+            self._output_format,
+            self._schema_version
+        ).validate_str(output)
+        if validation_error:
+            self._logger.debug('Validation Errors: %r', validation_error.data)
+            raise ValueError('output is schema-invalid to '
+                             f'{self._schema_version.to_version()}/{self._output_format.name}')
+        self._logger.info('Valid.')
+        return True
+
+    def write(self, output: str, outfile: TextIO) -> int:
+        self._logger.info('Writing to: %s', outfile.name)
+        written = outfile.write(output)
+        self._logger.info('Wrote %i bytes to %s', written, outfile.name)
+        return written
+
+    def make_output(self, bom: Bom) -> str:
+        self._logger.info('Serializing SBOM: %s/%s', self._schema_version.to_version(), self._output_format.name)
+        return make_outputter(
+            bom,
+            self._output_format,
+            self._schema_version
+        ).output_as_string(indent=2)
+
+    def make_bom(self, **kwargs: Any) -> Bom:
+        self._logger.info('Generating SBOM ...')
+        return self._bbc(**self._clean_kwargs(kwargs))
+
+    def __call__(self,
+                 outfile: TextIO,
+                 **kwargs: Any) -> None:
+        output = self.make_output(self.make_bom(**kwargs))
+        self.validate(output)
+        self.write(output, outfile)
 
 
 def main(**kwargs: Any) -> int:
-    return Command(**vars(Command.make_argument_parser(**kwargs).parse_args()))()
+    arg_co = argparse.ArgumentParser(add_help=False)
+    arg_co.add_argument('-v', '--verbose',
+                        help='verbose help TODO',
+                        dest='verbosity',
+                        action='count',
+                        default=0)
+    arg_parser = Command.make_argument_parser(sco=arg_co, **kwargs)
+    del arg_co
+    args = vars(arg_parser.parse_args())
+
+    ll = (logging.ERROR, logging.WARNING, logging.INFO, logging.DEBUG)[min(3, args.pop('verbosity'))]
+    lh = logging.StreamHandler(stderr)
+    lh.setLevel(ll)
+    lh.setFormatter(logging.Formatter('%(levelname)-8s | %(message)s'))
+    logger = logging.getLogger(__name__)
+    logger.propagate = False
+    logger.setLevel(ll)
+    logger.addHandler(lh)
+    del lh, ll
+    logger.debug('args: %s', args)
+
+    try:
+        Command(logger=logger, **args)(**args)
+    except Exception as error:
+        logger.exception('Error: %s', error, exc_info=error)
+        return 1
+    return 0

From 30cac78094d736bd25051848e22bc41830c40dc7 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 29 Oct 2023 01:06:27 +0200
Subject: [PATCH 009/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py |  28 ++++++++
 cyclonedx_py/_internal/cli.py      | 111 ++++++++---------------------
 cyclonedx_py/_internal/demo.py     |  49 +++++++++++++
 3 files changed, 108 insertions(+), 80 deletions(-)
 create mode 100644 cyclonedx_py/_internal/demo.py

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 79162ccd..54155aae 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -15,7 +15,35 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
+
 """
 This package is internal - it is not public API.
 All in here may have breaking change without notice.
 """
+
+
+from abc import ABC, abstractmethod
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from argparse import ArgumentParser
+    from logging import Logger
+
+    from cyclonedx.model.bom import Bom
+
+
+class BomBuilder(ABC):
+    @staticmethod
+    @abstractmethod
+    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
+        ...
+
+    @abstractmethod
+    def __init__(self,
+                 logger: 'Logger',
+                 **kwargs: Any) -> None:
+        ...
+
+    @abstractmethod
+    def __call__(self, **kwargs: Any) -> 'Bom':
+        ...
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index de8be283..4b1d2bd8 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -14,107 +14,56 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
-import argparse
-import logging
-from abc import ABC, abstractmethod
-from sys import stderr
-from typing import Any, BinaryIO, Dict, List, Optional, TextIO, Type, Union
 
-from cyclonedx.model.bom import Bom
+
+from argparse import ArgumentDefaultsHelpFormatter, ArgumentParser, ArgumentTypeError, FileType
+from typing import TYPE_CHECKING, Any, Dict, Optional, TextIO, Type
+
 from cyclonedx.output import make_outputter
 from cyclonedx.schema import OutputFormat, SchemaVersion
 from cyclonedx.validation import make_schemabased_validator
 
 from .. import __version__
+from .demo import Demo
 
+if TYPE_CHECKING:
+    from argparse import Action
+    from logging import Logger
 
-class CS_BomBuilder(ABC):
-    @staticmethod
-    @abstractmethod
-    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
-        ...
-
-    @abstractmethod
-    def __init__(self,
-                 logger: logging.Logger,
-                 **kwargs: Any) -> None:
-        ...
-
-    @abstractmethod
-    def __call__(self, **kwargs: Any) -> Bom:
-        ...
+    from cyclonedx.model.bom import Bom
 
+    from . import BomBuilder
 
-class CS_foo(CS_BomBuilder):
-    @staticmethod
-    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
-        p = argparse.ArgumentParser(description='description CS_foo TODO', **kwargs)
-        p.add_argument('-i', '--infile',
-                       help='I HELP TODO',
-                       type=argparse.FileType('rb'),
-                       default='poetry.lock')
-        return p
-
-    def __init__(self,
-                 logger: logging.Logger,
-                 **kwargs: Any) -> None:
-        self._logger = logger
+    BooleanOptionalAction: Optional[Type[Action]]
 
-    def __call__(self,  # type:ignore[override]
-                 infile: BinaryIO,
-                 **kwargs: Any) -> Bom:
-        self._logger.info('ogogog')
-        return Bom()
-
-
-class CS_bar(CS_BomBuilder):
-    @staticmethod
-    def make_argument_parser(**kwargs: Any) -> argparse.ArgumentParser:
-        p = argparse.ArgumentParser(description='description CS_bar TODO', **kwargs)
-        p.add_argument('-i', '--infile',
-                       help='I HELP TODO.\nSet to "-" to read from STDIN.',
-                       nargs=argparse.ONE_OR_MORE,
-                       type=argparse.FileType('rb'),
-                       default='-')
-        return p
-
-    def __init__(self,
-                 logger: logging.Logger,
-                 **kwargs: Any) -> None:
-        self._logger = logger
-
-    def __call__(self,  # type:ignore[override]
-                 infile: Union[List[BinaryIO], BinaryIO],
-                 **kwargs: Any) -> Bom:
-        infile = infile if isinstance(infile, list) else [infile]
-        self._logger.info('lololol')
-        return Bom()
+try:
+    from argparse import BooleanOptionalAction
+except ImportError:
+    BooleanOptionalAction = None
 
 
 class Command:
     @staticmethod
-    def make_argument_parser(sco: argparse.ArgumentParser, **kwargs: Any) -> argparse.ArgumentParser:
-        BooleanOptionalAction: Optional[argparse.Action] = getattr(argparse, 'BooleanOptionalAction', None)
-
+    def make_argument_parser(sco: ArgumentParser, **kwargs: Any) -> ArgumentParser:
         def mk_OutputFormatCI(value: str) -> OutputFormat:
             try:
                 return OutputFormat[value.upper()]
             except KeyError:
-                raise argparse.ArgumentTypeError(f'unsupported value {value!r}')
+                raise ArgumentTypeError(f'unsupported value {value!r}')
 
-        p = argparse.ArgumentParser(
+        p = ArgumentParser(
             description='description TODO',
-            formatter_class=argparse.ArgumentDefaultsHelpFormatter,
+            formatter_class=ArgumentDefaultsHelpFormatter,
             allow_abbrev=False,
             **kwargs)
         p.add_argument('--version', action='version', version=__version__)
         sp = p.add_subparsers(metavar='command', required=True)
 
-        op = argparse.ArgumentParser(add_help=False)
+        op = ArgumentParser(add_help=False)
         op.add_argument('-o', '--outfile',
                         help='O HELP TODO.\nSet to "-" to write to STDOUT.',
                         dest='outfile',
-                        type=argparse.FileType('w', encoding='utf8'),
+                        type=FileType('w', encoding='utf8'),
                         default='-')
         op.add_argument('--schema-version',
                         help='SV TODO\n'
@@ -136,7 +85,7 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
             op.add_argument('--validate',
                             help='validate HELP TODO',
                             dest='validate',
-                            action=argparse.BooleanOptionalAction,
+                            action=BooleanOptionalAction,
                             default=True)
         else:
             vg = op.add_mutually_exclusive_group()
@@ -151,8 +100,7 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
                             action='store_false')
 
         for sct, scc, scd in (
-            ('foo', CS_foo, 'foo description'),
-            ('bar', CS_bar, 'bar description'),
+            ('demo', Demo, 'Demo TODO'),
         ):
             spp = scc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
@@ -172,11 +120,11 @@ def _clean_kwargs(cls, kwargs: Dict[str, Any]) -> Dict[str, Any]:
         return {k: kwargs[k] for k in kwargs if k not in cls.__OWN_ARGS}
 
     def __init__(self, *,
-                 logger: logging.Logger,
+                 logger: 'Logger',
                  validate: bool,
                  output_format: OutputFormat,
                  schema_version: SchemaVersion,
-                 bbc: Type[CS_BomBuilder],
+                 bbc: Type['BomBuilder'],
                  **kwargs: Any) -> None:
         self._logger = logger
         self._output_format = output_format
@@ -206,7 +154,7 @@ def write(self, output: str, outfile: TextIO) -> int:
         self._logger.info('Wrote %i bytes to %s', written, outfile.name)
         return written
 
-    def make_output(self, bom: Bom) -> str:
+    def make_output(self, bom: 'Bom') -> str:
         self._logger.info('Serializing SBOM: %s/%s', self._schema_version.to_version(), self._output_format.name)
         return make_outputter(
             bom,
@@ -214,7 +162,7 @@ def make_output(self, bom: Bom) -> str:
             self._schema_version
         ).output_as_string(indent=2)
 
-    def make_bom(self, **kwargs: Any) -> Bom:
+    def make_bom(self, **kwargs: Any) -> 'Bom':
         self._logger.info('Generating SBOM ...')
         return self._bbc(**self._clean_kwargs(kwargs))
 
@@ -227,7 +175,10 @@ def __call__(self,
 
 
 def main(**kwargs: Any) -> int:
-    arg_co = argparse.ArgumentParser(add_help=False)
+    import logging
+    from sys import stderr
+
+    arg_co = ArgumentParser(add_help=False)
     arg_co.add_argument('-v', '--verbose',
                         help='verbose help TODO',
                         dest='verbosity',
diff --git a/cyclonedx_py/_internal/demo.py b/cyclonedx_py/_internal/demo.py
new file mode 100644
index 00000000..ce2e2316
--- /dev/null
+++ b/cyclonedx_py/_internal/demo.py
@@ -0,0 +1,49 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from argparse import ArgumentParser, FileType
+from typing import TYPE_CHECKING, Any, BinaryIO
+
+from cyclonedx.model.bom import Bom
+
+from . import BomBuilder
+
+if TYPE_CHECKING:
+    from logging import Logger
+
+
+class Demo(BomBuilder):
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> ArgumentParser:
+        p = ArgumentParser(description='description Demo TODO', **kwargs)
+        p.add_argument('-i', '--infile',
+                       help='I HELP TODO',
+                       type=FileType('rb'),
+                       default='poetry.lock')
+        return p
+
+    def __init__(self,
+                 logger: 'Logger',
+                 **kwargs: Any) -> None:
+        self._logger = logger
+
+    def __call__(self,  # type:ignore[override]
+                 infile: BinaryIO,
+                 **kwargs: Any) -> Bom:
+        self._logger.info('ogogog')
+        return Bom()

From 67cf534750f3a4cff1b231150765ca4fb8314613 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 29 Oct 2023 01:49:16 +0200
Subject: [PATCH 010/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 4b1d2bd8..ee4ec214 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -15,7 +15,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
-
+import sys
 from argparse import ArgumentDefaultsHelpFormatter, ArgumentParser, ArgumentTypeError, FileType
 from typing import TYPE_CHECKING, Any, Dict, Optional, TextIO, Type
 
@@ -36,9 +36,9 @@
 
     BooleanOptionalAction: Optional[Type[Action]]
 
-try:
+if sys.version_info >= (3, 9):
     from argparse import BooleanOptionalAction
-except ImportError:
+else:
     BooleanOptionalAction = None
 
 

From 74831a0d961737fc71f1453d22da73271aeabd17 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 29 Oct 2023 02:02:30 +0200
Subject: [PATCH 011/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index ee4ec214..1d23b6b4 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -44,13 +44,14 @@
 
 class Command:
     @staticmethod
-    def make_argument_parser(sco: ArgumentParser, **kwargs: Any) -> ArgumentParser:
-        def mk_OutputFormatCI(value: str) -> OutputFormat:
-            try:
-                return OutputFormat[value.upper()]
-            except KeyError:
-                raise ArgumentTypeError(f'unsupported value {value!r}')
+    def _mk_OutputFormatCI(value: str) -> OutputFormat:
+        try:
+            return OutputFormat[value.upper()]
+        except KeyError:
+            raise ArgumentTypeError(f'unsupported value {value!r}')
 
+    @classmethod
+    def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentParser:
         p = ArgumentParser(
             description='description TODO',
             formatter_class=ArgumentDefaultsHelpFormatter,
@@ -79,7 +80,7 @@ def mk_OutputFormatCI(value: str) -> OutputFormat:
                         metavar='FORMAT',
                         dest='output_format',
                         choices=OutputFormat,
-                        type=mk_OutputFormatCI,
+                        type=cls._mk_OutputFormatCI,
                         default=OutputFormat.JSON.name)
         if BooleanOptionalAction:
             op.add_argument('--validate',

From 9c2e416840c5174bd65aee63b71d4d886fbc28bd Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 29 Oct 2023 02:17:42 +0200
Subject: [PATCH 012/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py  |  9 +++++++--
 cyclonedx_py/_internal/demo.py | 10 ++++++++--
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 1d23b6b4..c7b8a87f 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -16,7 +16,8 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 import sys
-from argparse import ArgumentDefaultsHelpFormatter, ArgumentParser, ArgumentTypeError, FileType
+from argparse import ArgumentDefaultsHelpFormatter, ArgumentParser, ArgumentTypeError, FileType, \
+    RawDescriptionHelpFormatter
 from typing import TYPE_CHECKING, Any, Dict, Optional, TextIO, Type
 
 from cyclonedx.output import make_outputter
@@ -50,11 +51,14 @@ def _mk_OutputFormatCI(value: str) -> OutputFormat:
         except KeyError:
             raise ArgumentTypeError(f'unsupported value {value!r}')
 
+    class _MyArgFormatter(ArgumentDefaultsHelpFormatter,RawDescriptionHelpFormatter):
+        pass
+
     @classmethod
     def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentParser:
         p = ArgumentParser(
             description='description TODO',
-            formatter_class=ArgumentDefaultsHelpFormatter,
+            formatter_class=cls._MyArgFormatter,
             allow_abbrev=False,
             **kwargs)
         p.add_argument('--version', action='version', version=__version__)
@@ -107,6 +111,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
             sp.add_parser(sct,
                           help=scd,
                           description=spp.description,
+                          epilog=spp.epilog,
                           parents=[spp, op, sco],
                           formatter_class=p.formatter_class,
                           allow_abbrev=p.allow_abbrev,
diff --git a/cyclonedx_py/_internal/demo.py b/cyclonedx_py/_internal/demo.py
index ce2e2316..743e8708 100644
--- a/cyclonedx_py/_internal/demo.py
+++ b/cyclonedx_py/_internal/demo.py
@@ -17,6 +17,7 @@
 
 
 from argparse import ArgumentParser, FileType
+from textwrap import dedent
 from typing import TYPE_CHECKING, Any, BinaryIO
 
 from cyclonedx.model.bom import Bom
@@ -30,11 +31,16 @@
 class Demo(BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> ArgumentParser:
-        p = ArgumentParser(description='description Demo TODO', **kwargs)
+        p = ArgumentParser(description='description Demo TODO',
+                           epilog=dedent('''\
+                           example usage:
+                              %(prog)s -i requirements/*.txt
+                           '''),
+                           **kwargs)
         p.add_argument('-i', '--infile',
                        help='I HELP TODO',
                        type=FileType('rb'),
-                       default='poetry.lock')
+                       default='requirements.txt')
         return p
 
     def __init__(self,

From 42fa771da8e308fb7adf2effb841b88c4284335d Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 29 Oct 2023 13:10:57 +0100
Subject: [PATCH 013/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py                 | 52 ++++++++++---------
 .../_internal/{demo.py => requirements.py}    | 13 +++--
 2 files changed, 36 insertions(+), 29 deletions(-)
 rename cyclonedx_py/_internal/{demo.py => requirements.py} (78%)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index c7b8a87f..f9e7f958 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -16,8 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 import sys
-from argparse import ArgumentDefaultsHelpFormatter, ArgumentParser, ArgumentTypeError, FileType, \
-    RawDescriptionHelpFormatter
+from argparse import ArgumentParser, ArgumentTypeError, FileType, RawDescriptionHelpFormatter
 from typing import TYPE_CHECKING, Any, Dict, Optional, TextIO, Type
 
 from cyclonedx.output import make_outputter
@@ -25,7 +24,7 @@
 from cyclonedx.validation import make_schemabased_validator
 
 from .. import __version__
-from .demo import Demo
+from .requirements import RequirementsBB
 
 if TYPE_CHECKING:
     from argparse import Action
@@ -51,36 +50,37 @@ def _mk_OutputFormatCI(value: str) -> OutputFormat:
         except KeyError:
             raise ArgumentTypeError(f'unsupported value {value!r}')
 
-    class _MyArgFormatter(ArgumentDefaultsHelpFormatter,RawDescriptionHelpFormatter):
-        pass
-
     @classmethod
     def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentParser:
         p = ArgumentParser(
-            description='description TODO',
-            formatter_class=cls._MyArgFormatter,
+            description='Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.',
+            formatter_class=RawDescriptionHelpFormatter,
             allow_abbrev=False,
             **kwargs)
         p.add_argument('--version', action='version', version=__version__)
-        sp = p.add_subparsers(metavar='command', required=True)
+        sp = p.add_subparsers(metavar='command', dest='command',
+                              # not required. if omitted: show help and exit
+                              required=False)
 
         op = ArgumentParser(add_help=False)
         op.add_argument('-o', '--outfile',
-                        help='O HELP TODO.\nSet to "-" to write to STDOUT.',
+                        help='Output file path for your SBOM (set to "-" to output to STDOUT) (default: %(default)s)',
                         dest='outfile',
                         type=FileType('w', encoding='utf8'),
                         default='-')
-        op.add_argument('--schema-version',
-                        help='SV TODO\n'
-                             f'{{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}',
-                        metavar='',
+        op.add_argument('--sv', '--schema-version',
+                        help='The CycloneDX schema version for your SBOM'
+                             f' {{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}'
+                             ' (default: %(default)s)',
+                        metavar='VERSION',
                         dest='schema_version',
                         choices=SchemaVersion,
                         type=SchemaVersion.from_version,
                         default=SchemaVersion.V1_4.to_version())
-        op.add_argument('--output-format',
-                        help='OF TODO\n'
-                             f'{{choice: {", ".join(sorted(f.name for f in OutputFormat))}}}',
+        op.add_argument('--of', '--output-format',
+                        help='The output format for your SBOM'
+                             f' {{choice: {", ".join(sorted(f.name for f in OutputFormat))}}}'
+                             ' (default: %(default)s)',
                         metavar='FORMAT',
                         dest='output_format',
                         choices=OutputFormat,
@@ -88,24 +88,24 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                         default=OutputFormat.JSON.name)
         if BooleanOptionalAction:
             op.add_argument('--validate',
-                            help='validate HELP TODO',
+                            help='Whether validate the result before outputting (default: %(default)s)',
                             dest='validate',
                             action=BooleanOptionalAction,
                             default=True)
         else:
             vg = op.add_mutually_exclusive_group()
             vg.add_argument('--validate',
-                            help='validate HELP TODO',
+                            help='Validate the result before outputting (default: %(default)s)',
                             dest='validate',
                             action='store_true',
                             default=True)
             vg.add_argument('--no-validate',
-                            help='no-validate HELP TODO',
+                            help='Do not validate the result before outputting',
                             dest='validate',
                             action='store_false')
 
         for sct, scc, scd in (
-            ('demo', Demo, 'Demo TODO'),
+            ('requirements', RequirementsBB, 'HELP TODO'),
         ):
             spp = scc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
@@ -186,7 +186,7 @@ def main(**kwargs: Any) -> int:
 
     arg_co = ArgumentParser(add_help=False)
     arg_co.add_argument('-v', '--verbose',
-                        help='verbose help TODO',
+                        help='Increase the verbosity of messages (multiple for more effect) (default: silent)',
                         dest='verbosity',
                         action='count',
                         default=0)
@@ -194,11 +194,15 @@ def main(**kwargs: Any) -> int:
     del arg_co
     args = vars(arg_parser.parse_args())
 
+    if args['command'] is None:
+        arg_parser.print_help()
+        return 1
+
     ll = (logging.ERROR, logging.WARNING, logging.INFO, logging.DEBUG)[min(3, args.pop('verbosity'))]
     lh = logging.StreamHandler(stderr)
     lh.setLevel(ll)
-    lh.setFormatter(logging.Formatter('%(levelname)-8s | %(message)s'))
-    logger = logging.getLogger(__name__)
+    lh.setFormatter(logging.Formatter('%(levelname)-8s | %(name)s > %(message)s'))
+    logger = logging.getLogger('CDX')
     logger.propagate = False
     logger.setLevel(ll)
     logger.addHandler(lh)
diff --git a/cyclonedx_py/_internal/demo.py b/cyclonedx_py/_internal/requirements.py
similarity index 78%
rename from cyclonedx_py/_internal/demo.py
rename to cyclonedx_py/_internal/requirements.py
index 743e8708..4f9c3893 100644
--- a/cyclonedx_py/_internal/demo.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,9 +16,9 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from argparse import ArgumentParser, FileType
+from argparse import ArgumentParser, FileType, ONE_OR_MORE
 from textwrap import dedent
-from typing import TYPE_CHECKING, Any, BinaryIO
+from typing import TYPE_CHECKING, Any, BinaryIO, List, Union
 
 from cyclonedx.model.bom import Bom
 
@@ -28,10 +28,10 @@
     from logging import Logger
 
 
-class Demo(BomBuilder):
+class RequirementsBB(BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> ArgumentParser:
-        p = ArgumentParser(description='description Demo TODO',
+        p = ArgumentParser(description='Build an SBOM based on `requirements.txt`-like structures.',
                            epilog=dedent('''\
                            example usage:
                               %(prog)s -i requirements/*.txt
@@ -39,6 +39,7 @@ def make_argument_parser(**kwargs: Any) -> ArgumentParser:
                            **kwargs)
         p.add_argument('-i', '--infile',
                        help='I HELP TODO',
+                       nargs=ONE_OR_MORE,
                        type=FileType('rb'),
                        default='requirements.txt')
         return p
@@ -49,7 +50,9 @@ def __init__(self,
         self._logger = logger
 
     def __call__(self,  # type:ignore[override]
-                 infile: BinaryIO,
+                 infile: Union[List[BinaryIO], BinaryIO],
                  **kwargs: Any) -> Bom:
+        if not isinstance(infile, list):
+            infile = [infile]
         self._logger.info('ogogog')
         return Bom()

From 758c83cfa8df2b74d16810627e83d363fad2e507 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 29 Oct 2023 23:57:31 +0100
Subject: [PATCH 014/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index f9e7f958..e52c16e1 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -149,8 +149,12 @@ def validate(self, output: str) -> bool:
         ).validate_str(output)
         if validation_error:
             self._logger.debug('Validation Errors: %r', validation_error.data)
-            raise ValueError('output is schema-invalid to '
-                             f'{self._schema_version.to_version()}/{self._output_format.name}')
+            self._logger.error('The output is invalid to schema '
+                               f'{self._schema_version.to_version()}/{self._output_format.name}')
+            self._logger.error('Please report the issue and provide all input data to: '
+                               'https://github.com/CycloneDX/cyclonedx-python/issues/new?'
+                               'template=ValidationError-report.md&labels=ValidationError&title=%5BValidationError%5D')
+            raise ValueError('Output is schema-invalid')
         self._logger.info('Valid.')
         return True
 
@@ -212,6 +216,7 @@ def main(**kwargs: Any) -> int:
     try:
         Command(logger=logger, **args)(**args)
     except Exception as error:
-        logger.exception('Error: %s', error, exc_info=error)
+        logger.debug('Error: %s', error, exc_info=error)
+        logger.critical(f'{error}')
         return 1
     return 0

From ee7463b2c8058a8164e757935ced80dff8a89404 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 30 Oct 2023 00:02:03 +0100
Subject: [PATCH 015/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index e52c16e1..0e494ded 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -66,7 +66,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
         op.add_argument('-o', '--outfile',
                         help='Output file path for your SBOM (set to "-" to output to STDOUT) (default: %(default)s)',
                         dest='outfile',
-                        type=FileType('w', encoding='utf8'),
+                        type=FileType('wt', encoding='utf8'),
                         default='-')
         op.add_argument('--sv', '--schema-version',
                         help='The CycloneDX schema version for your SBOM'

From 5913bb3eb23efb3865cd5619157e208aa434180a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 30 Oct 2023 00:03:12 +0100
Subject: [PATCH 016/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 4f9c3893..91f540f1 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from argparse import ArgumentParser, FileType, ONE_OR_MORE
+from argparse import ONE_OR_MORE, ArgumentParser, FileType
 from textwrap import dedent
 from typing import TYPE_CHECKING, Any, BinaryIO, List, Union
 

From a7c21274ec86989a8b920902daf26791cb9805f9 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 30 Oct 2023 15:12:16 +0100
Subject: [PATCH 017/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py          |  4 ++
 cyclonedx_py/_internal/pipenv.py       | 53 ++++++++++++++++++++++++++
 cyclonedx_py/_internal/poetry.py       | 51 +++++++++++++++++++++++++
 cyclonedx_py/_internal/requirements.py | 23 ++++++-----
 4 files changed, 119 insertions(+), 12 deletions(-)
 create mode 100644 cyclonedx_py/_internal/pipenv.py
 create mode 100644 cyclonedx_py/_internal/poetry.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 0e494ded..4b8074de 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -24,6 +24,8 @@
 from cyclonedx.validation import make_schemabased_validator
 
 from .. import __version__
+from .pipenv import PipenvBB
+from .poetry import PoetryBB
 from .requirements import RequirementsBB
 
 if TYPE_CHECKING:
@@ -106,6 +108,8 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
 
         for sct, scc, scd in (
             ('requirements', RequirementsBB, 'HELP TODO'),
+            ('pipenv', PipenvBB, 'HELP TODO'),
+            ('poetry', PoetryBB, 'HELP TODO'),
         ):
             spp = scc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
new file mode 100644
index 00000000..3cdb7693
--- /dev/null
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -0,0 +1,53 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from argparse import OPTIONAL, ArgumentParser, FileType
+from typing import TYPE_CHECKING, Any, BinaryIO
+
+from cyclonedx.model.bom import Bom
+
+from . import BomBuilder
+
+if TYPE_CHECKING:
+    from logging import Logger
+
+
+class PipenvBB(BomBuilder):
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> ArgumentParser:
+        p = ArgumentParser(description='Build an SBOM based on PipEnv',
+                           **kwargs)
+        p.add_argument('lock-file',
+                       help='I HELP TODO (default: %(default)s)',
+                       nargs=OPTIONAL,
+                       type=FileType('rb'),
+                       default='Pipfile.lock')
+        return p
+
+    def __init__(self,
+                 logger: 'Logger',
+                 **kwargs: Any) -> None:
+        self._logger = logger
+
+    def __call__(self,  # type:ignore[override]
+                 infile: BinaryIO,
+                 **kwargs: Any) -> Bom:
+        if not isinstance(infile, list):
+            infile = [infile]
+        # TODO
+        return Bom()
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
new file mode 100644
index 00000000..92995d2a
--- /dev/null
+++ b/cyclonedx_py/_internal/poetry.py
@@ -0,0 +1,51 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from argparse import OPTIONAL, ArgumentParser, FileType
+from typing import TYPE_CHECKING, Any, BinaryIO
+
+from cyclonedx.model.bom import Bom
+
+from . import BomBuilder
+
+if TYPE_CHECKING:
+    from logging import Logger
+
+
+class PoetryBB(BomBuilder):
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> ArgumentParser:
+        p = ArgumentParser(description='Build an SBOM based on Poetry environment.',
+                           **kwargs)
+        p.add_argument('lock-file',
+                       help='I HELP TODO (default: %(default)s)',
+                       nargs=OPTIONAL,
+                       type=FileType('rb'),
+                       default='poetry.lock')
+        return p
+
+    def __init__(self,
+                 logger: 'Logger',
+                 **kwargs: Any) -> None:
+        self._logger = logger
+
+    def __call__(self,  # type:ignore[override]
+                 infile: BinaryIO,
+                 **kwargs: Any) -> Bom:
+        # TODO
+        return Bom()
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 91f540f1..3719e7ea 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,9 +16,9 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from argparse import ONE_OR_MORE, ArgumentParser, FileType
+from argparse import OPTIONAL, ArgumentParser, FileType
 from textwrap import dedent
-from typing import TYPE_CHECKING, Any, BinaryIO, List, Union
+from typing import TYPE_CHECKING, Any, BinaryIO
 
 from cyclonedx.model.bom import Bom
 
@@ -31,15 +31,16 @@
 class RequirementsBB(BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> ArgumentParser:
-        p = ArgumentParser(description='Build an SBOM based on `requirements.txt`-like structures.',
+        p = ArgumentParser(description='Build an SBOM from requirements file.',
                            epilog=dedent('''\
-                           example usage:
-                              %(prog)s -i requirements/*.txt
+                           Example Usage:
+                             • Merge multiple files and build an SBOM from it:
+                                   $ cat requirements/*.txt | %(prog)s -
                            '''),
                            **kwargs)
-        p.add_argument('-i', '--infile',
-                       help='I HELP TODO',
-                       nargs=ONE_OR_MORE,
+        p.add_argument('infile',
+                       help='I HELP TODO (default: %(default)s)',
+                       nargs=OPTIONAL,
                        type=FileType('rb'),
                        default='requirements.txt')
         return p
@@ -50,9 +51,7 @@ def __init__(self,
         self._logger = logger
 
     def __call__(self,  # type:ignore[override]
-                 infile: Union[List[BinaryIO], BinaryIO],
+                 infile: BinaryIO,
                  **kwargs: Any) -> Bom:
-        if not isinstance(infile, list):
-            infile = [infile]
-        self._logger.info('ogogog')
+        # TODO
         return Bom()

From a98ca4bd9d25333ce9d10694729a459b3b837281 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 30 Oct 2023 17:37:48 +0100
Subject: [PATCH 018/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py     |  6 ------
 cyclonedx_py/_internal/cli.py          |  8 ++++++--
 cyclonedx_py/_internal/pipenv.py       | 19 ++++++++++++++-----
 cyclonedx_py/_internal/poetry.py       | 19 ++++++++++++++-----
 cyclonedx_py/_internal/requirements.py | 22 ++++++++++++++++------
 5 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 54155aae..7762969f 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -16,12 +16,6 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-"""
-This package is internal - it is not public API.
-All in here may have breaking change without notice.
-"""
-
-
 from abc import ABC, abstractmethod
 from typing import TYPE_CHECKING, Any
 
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 4b8074de..20a777a5 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -19,9 +19,7 @@
 from argparse import ArgumentParser, ArgumentTypeError, FileType, RawDescriptionHelpFormatter
 from typing import TYPE_CHECKING, Any, Dict, Optional, TextIO, Type
 
-from cyclonedx.output import make_outputter
 from cyclonedx.schema import OutputFormat, SchemaVersion
-from cyclonedx.validation import make_schemabased_validator
 
 from .. import __version__
 from .pipenv import PipenvBB
@@ -45,6 +43,7 @@
 
 
 class Command:
+
     @staticmethod
     def _mk_OutputFormatCI(value: str) -> OutputFormat:
         try:
@@ -146,7 +145,10 @@ def validate(self, output: str) -> bool:
         if not self._validate:
             self._logger.warning('Validation skipped.')
             return False
+
         self._logger.info('Validating to schema: %s/%s', self._schema_version.to_version(), self._output_format.name)
+        from cyclonedx.validation import make_schemabased_validator
+
         validation_error = make_schemabased_validator(
             self._output_format,
             self._schema_version
@@ -170,6 +172,8 @@ def write(self, output: str, outfile: TextIO) -> int:
 
     def make_output(self, bom: 'Bom') -> str:
         self._logger.info('Serializing SBOM: %s/%s', self._schema_version.to_version(), self._output_format.name)
+        from cyclonedx.output import make_outputter
+
         return make_outputter(
             bom,
             self._output_format,
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 3cdb7693..377431b7 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -16,20 +16,27 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from argparse import OPTIONAL, ArgumentParser, FileType
 from typing import TYPE_CHECKING, Any, BinaryIO
 
-from cyclonedx.model.bom import Bom
-
 from . import BomBuilder
 
 if TYPE_CHECKING:
+    from argparse import ArgumentParser
     from logging import Logger
 
+    from cyclonedx.model.bom import Bom
+
+
+# !!! be as lazy loading as possible, as greedy as needed
+# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+
 
 class PipenvBB(BomBuilder):
+
     @staticmethod
-    def make_argument_parser(**kwargs: Any) -> ArgumentParser:
+    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
+        from argparse import OPTIONAL, ArgumentParser, FileType
+
         p = ArgumentParser(description='Build an SBOM based on PipEnv',
                            **kwargs)
         p.add_argument('lock-file',
@@ -46,7 +53,9 @@ def __init__(self,
 
     def __call__(self,  # type:ignore[override]
                  infile: BinaryIO,
-                 **kwargs: Any) -> Bom:
+                 **kwargs: Any) -> 'Bom':
+        from cyclonedx.model.bom import Bom
+
         if not isinstance(infile, list):
             infile = [infile]
         # TODO
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 92995d2a..065c45c4 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,20 +16,27 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from argparse import OPTIONAL, ArgumentParser, FileType
 from typing import TYPE_CHECKING, Any, BinaryIO
 
-from cyclonedx.model.bom import Bom
-
 from . import BomBuilder
 
 if TYPE_CHECKING:
+    from argparse import ArgumentParser
     from logging import Logger
 
+    from cyclonedx.model.bom import Bom
+
+
+# !!! be as lazy loading as possible, as greedy as needed
+# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+
 
 class PoetryBB(BomBuilder):
+
     @staticmethod
-    def make_argument_parser(**kwargs: Any) -> ArgumentParser:
+    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
+        from argparse import OPTIONAL, ArgumentParser, FileType
+
         p = ArgumentParser(description='Build an SBOM based on Poetry environment.',
                            **kwargs)
         p.add_argument('lock-file',
@@ -46,6 +53,8 @@ def __init__(self,
 
     def __call__(self,  # type:ignore[override]
                  infile: BinaryIO,
-                 **kwargs: Any) -> Bom:
+                 **kwargs: Any) -> 'Bom':
+        from cyclonedx.model.bom import Bom
+
         # TODO
         return Bom()
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 3719e7ea..50bf21e7 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,21 +16,28 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from argparse import OPTIONAL, ArgumentParser, FileType
-from textwrap import dedent
 from typing import TYPE_CHECKING, Any, BinaryIO
 
-from cyclonedx.model.bom import Bom
-
 from . import BomBuilder
 
 if TYPE_CHECKING:
+    from argparse import ArgumentParser
     from logging import Logger
 
+    from cyclonedx.model.bom import Bom
+
+
+# !!! be as lazy loading as possible, as greedy as needed
+# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+
 
 class RequirementsBB(BomBuilder):
+
     @staticmethod
-    def make_argument_parser(**kwargs: Any) -> ArgumentParser:
+    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
+        from argparse import OPTIONAL, ArgumentParser, FileType
+        from textwrap import dedent
+
         p = ArgumentParser(description='Build an SBOM from requirements file.',
                            epilog=dedent('''\
                            Example Usage:
@@ -52,6 +59,9 @@ def __init__(self,
 
     def __call__(self,  # type:ignore[override]
                  infile: BinaryIO,
-                 **kwargs: Any) -> Bom:
+                 **kwargs: Any) -> 'Bom':
+        from cyclonedx.model.bom import Bom
+
         # TODO
+
         return Bom()

From 7c1bcdd3ed27c40fa0823d84c1cee7f876a3cf63 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 30 Oct 2023 17:56:13 +0100
Subject: [PATCH 019/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 50bf21e7..a162dd7a 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -38,11 +38,18 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser, FileType
         from textwrap import dedent
 
-        p = ArgumentParser(description='Build an SBOM from requirements file.',
+        p = ArgumentParser(description='Build an SBOM from frozen requirements.',
                            epilog=dedent('''\
                            Example Usage:
+                             • Build an SBOM from a frozen requirements file:
+                                   $ %(prog)s requirements-prod.txt
                              • Merge multiple files and build an SBOM from it:
                                    $ cat requirements/*.txt | %(prog)s -
+                             • Build an inventory for all installed packages:
+                                   $ python3 -m pip freeze --all | %(prog)s -
+                             • Build an inventory from an unfrozen manifest:
+                                   $ python3 -m pip install -r dependencies.txt && \\
+                                     python3 -m pip freeze | %(prog)s -
                            '''),
                            **kwargs)
         p.add_argument('infile',

From 93056f18f7f2f8b4eabc94ea9c3bd5689790cabc Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 30 Oct 2023 17:58:07 +0100
Subject: [PATCH 020/155] poc

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/ISSUE_TEMPLATE/ValidationError-report.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/ValidationError-report.md b/.github/ISSUE_TEMPLATE/ValidationError-report.md
index 77285d4a..50e7a5cc 100644
--- a/.github/ISSUE_TEMPLATE/ValidationError-report.md
+++ b/.github/ISSUE_TEMPLATE/ValidationError-report.md
@@ -12,14 +12,14 @@ assignees: ''
 Steps to reproduce the behavior:
 
 1. How was _cyclonedx-py_  called?
-   <!-- e.g. `cyclonedx-py --omit=dev ...` -->
+   <!-- e.g. `cyclonedx-py requirements ...` -->
 2. What kind of evidence was processed?
    <!-- upload a complete project or set of other evidences to this issue, or a pastebin of you choice and put the link here. -->
 3. Error report:
    <!-- upload the complete output to this issue, or a pastebin of you choice and put the link here. -->
 4. Expected result:
    <!-- run the original call again
-   with parameters `--no-validate -o -`, 
+   with parameters `--no-validate -vvv -o -`, 
    then upload the output this issue, or to a pastebin of you choice and put the link here. -->
 
 ## Environment

From 1846a83f12129a56cf11085348c24361a393c50e Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 11:29:34 +0100
Subject: [PATCH 021/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 44 ++++++++++++++++++++++++--
 cyclonedx_py/_internal/utils/io.py     | 40 +++++++++++++++++++++++
 tests/_data/requirements-floating.txt  | 12 +++++++
 tests/_data/requirements-frozen.txt    |  3 ++
 tests/_data/requirements-local.txt     |  7 ++++
 tests/_data/requirements-url.txt       |  7 ++++
 6 files changed, 110 insertions(+), 3 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/io.py
 create mode 100644 tests/_data/requirements-floating.txt
 create mode 100644 tests/_data/requirements-frozen.txt
 create mode 100644 tests/_data/requirements-local.txt
 create mode 100644 tests/_data/requirements-url.txt

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index a162dd7a..d1debd67 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -48,7 +48,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                              • Build an inventory for all installed packages:
                                    $ python3 -m pip freeze --all | %(prog)s -
                              • Build an inventory from an unfrozen manifest:
-                                   $ python3 -m pip install -r dependencies.txt && \\
+                                   $ python3 -m pip install -r dependencies.txt &&\\
                                      python3 -m pip freeze | %(prog)s -
                            '''),
                            **kwargs)
@@ -67,8 +67,46 @@ def __init__(self,
     def __call__(self,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
+        from collections import Counter
+
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
         from cyclonedx.model.bom import Bom
+        from cyclonedx.model.component import Component, ComponentType
+        from packageurl import PackageURL
+        from pip_requirements_parser import RequirementsFile
+
+        from .utils.io import io2file
+
+        bom = Bom()
+        bom_refs = Counter()
+
+        with io2file(infile) as ff:
+            requirements = RequirementsFile.from_file(ff.name).requirements
+        for requirement in requirements:
+            name = requirement.name or None  # paths/urls may have no name
+            version = requirement.get_pinned_version or None
+            download_url = requirement.link.url if requirement.link else None
+            bom_ref = name
+            bom_refs[bom_ref] += 1
+            if bom_refs['bom_ref'] > 1:
+                bom_ref += f'-{bom_refs["bom_ref"]:x}'
+            component = Component(
+                type=ComponentType.LIBRARY,
+                name=name or 'unknown',
+                version=version,
+                hashes=map(HashType.from_composite_str, requirement.hash_options),
+                purl=PackageURL(type='pypi', name=name, version=version,
+                                qualifiers={'download_url': download_url} if download_url else None
+                                ) if name else None,
+                bom_ref=bom_ref,
+                external_references=[
+                    ExternalReference(type=ExternalReferenceType.DISTRIBUTION, url=XsUri(download_url))
+                ] if download_url else None
+            )
 
-        # TODO
+            self._logger.debug('Add component: %r', component)
+            if not component.version:
+                self._logger.warning('Component has no version: %r', component)
+            bom.components.add(component)
 
-        return Bom()
+        return bom
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
new file mode 100644
index 00000000..f9cde2b3
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -0,0 +1,40 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from tempfile import NamedTemporaryFile
+from typing import TYPE_CHECKING, BinaryIO
+
+from chardet import detect as chardetect
+
+if TYPE_CHECKING:
+    from tempfile import _TemporaryFileWrapper
+
+
+def io2str(io: BinaryIO) -> str:
+    data = io.read()
+    encoding = (chardetect(data)['encoding'] or '').replace(
+        # replace Windows-encoding with code-page
+        'Windows-', 'cp')
+    return data.decode(encoding)
+
+
+def io2file(io: BinaryIO) -> '_TemporaryFileWrapper':
+    tf = NamedTemporaryFile('wt', encoding='utf8')
+    tf.write(io2str(io))
+    tf.flush()
+    return tf
diff --git a/tests/_data/requirements-floating.txt b/tests/_data/requirements-floating.txt
new file mode 100644
index 00000000..b28396fe
--- /dev/null
+++ b/tests/_data/requirements-floating.txt
@@ -0,0 +1,12 @@
+
+# greater than
+ruamel.yaml >= 0.16
+
+# lower than
+yamale <= 3.0
+
+# no version at all
+werkzeug
+
+# from to
+click >= 7.1 , < 8.0
diff --git a/tests/_data/requirements-frozen.txt b/tests/_data/requirements-frozen.txt
new file mode 100644
index 00000000..aa337c2c
--- /dev/null
+++ b/tests/_data/requirements-frozen.txt
@@ -0,0 +1,3 @@
+# all dependencies are pinned to an exact version
+chardet==5.2.0
+colorama==0.4.6
diff --git a/tests/_data/requirements-local.txt b/tests/_data/requirements-local.txt
new file mode 100644
index 00000000..31e77d34
--- /dev/null
+++ b/tests/_data/requirements-local.txt
@@ -0,0 +1,7 @@
+# requirements from local path
+
+# named
+foo @ ../foo
+
+# unnamed
+./downloads/numpy-1.9.2-cp34-none-win32.whl
diff --git a/tests/_data/requirements-url.txt b/tests/_data/requirements-url.txt
new file mode 100644
index 00000000..a2794c0a
--- /dev/null
+++ b/tests/_data/requirements-url.txt
@@ -0,0 +1,7 @@
+# requirements from VCS -- https://pip.pypa.io/en/stable/reference/requirements-file-format/#example
+
+# named
+urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip
+
+# unnamed
+http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl

From 5efa84dca595599c7dcb1b3e8bf352370436c472 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 12:16:49 +0100
Subject: [PATCH 022/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py           | 16 ++++++++--------
 cyclonedx_py/_internal/utils/io.py               |  4 ++--
 tests/_data/.editorconfig                        |  4 ++++
 tests/_data/.gitattributes                       |  3 +++
 tests/_data/requirements-frozen.txt              |  8 +++++++-
 ...quirements-regression-issue448.cp1252.txt.bin |  6 ++++++
 6 files changed, 30 insertions(+), 11 deletions(-)
 create mode 100644 tests/_data/.editorconfig
 create mode 100644 tests/_data/.gitattributes
 create mode 100644 tests/_data/requirements-regression-issue448.cp1252.txt.bin

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index d1debd67..bdc21ea7 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -80,24 +80,24 @@ def __call__(self,  # type:ignore[override]
         bom = Bom()
         bom_refs = Counter()
 
+        # no support for `include_nested` intended, so a temp file instead the original path is fine
         with io2file(infile) as ff:
-            requirements = RequirementsFile.from_file(ff.name).requirements
+            requirements = RequirementsFile.from_file(ff.name, include_nested=False).requirements
         for requirement in requirements:
-            name = requirement.name or None  # paths/urls may have no name
             version = requirement.get_pinned_version or None
-            download_url = requirement.link.url if requirement.link else None
-            bom_ref = name
+            download_url = requirement.link and requirement.link.url or None
+            bom_ref = requirement.name or 'unknown'
             bom_refs[bom_ref] += 1
             if bom_refs['bom_ref'] > 1:
                 bom_ref += f'-{bom_refs["bom_ref"]:x}'
             component = Component(
                 type=ComponentType.LIBRARY,
-                name=name or 'unknown',
+                name=requirement.name or 'unknown',
                 version=version,
                 hashes=map(HashType.from_composite_str, requirement.hash_options),
-                purl=PackageURL(type='pypi', name=name, version=version,
-                                qualifiers={'download_url': download_url} if download_url else None
-                                ) if name else None,
+                purl=PackageURL(type='pypi', name=requirement.name, version=version,
+                                qualifiers=download_url and {'download_url': download_url}
+                                ) if requirement.name else None,
                 bom_ref=bom_ref,
                 external_references=[
                     ExternalReference(type=ExternalReferenceType.DISTRIBUTION, url=XsUri(download_url))
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index f9cde2b3..07df367e 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -34,7 +34,7 @@ def io2str(io: BinaryIO) -> str:
 
 
 def io2file(io: BinaryIO) -> '_TemporaryFileWrapper':
-    tf = NamedTemporaryFile('wt', encoding='utf8')
-    tf.write(io2str(io))
+    tf = NamedTemporaryFile('wb')
+    tf.write(io.read())
     tf.flush()
     return tf
diff --git a/tests/_data/.editorconfig b/tests/_data/.editorconfig
new file mode 100644
index 00000000..3de20f11
--- /dev/null
+++ b/tests/_data/.editorconfig
@@ -0,0 +1,4 @@
+
+[*.cp1252.txt.bin]
+charset = unset
+end_of_line = crlf
diff --git a/tests/_data/.gitattributes b/tests/_data/.gitattributes
new file mode 100644
index 00000000..b1ce527a
--- /dev/null
+++ b/tests/_data/.gitattributes
@@ -0,0 +1,3 @@
+*.bin       binary
+*.txt.bin   binary diff=text
+
diff --git a/tests/_data/requirements-frozen.txt b/tests/_data/requirements-frozen.txt
index aa337c2c..8bb1ebe8 100644
--- a/tests/_data/requirements-frozen.txt
+++ b/tests/_data/requirements-frozen.txt
@@ -1,3 +1,9 @@
 # all dependencies are pinned to an exact version
-chardet==5.2.0
+
+# just pinned
 colorama==0.4.6
+
+# with hashes -- https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode
+FooProject == 1.2 \
+  --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 \
+  --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7
diff --git a/tests/_data/requirements-regression-issue448.cp1252.txt.bin b/tests/_data/requirements-regression-issue448.cp1252.txt.bin
new file mode 100644
index 00000000..038e8d3f
--- /dev/null
+++ b/tests/_data/requirements-regression-issue448.cp1252.txt.bin
@@ -0,0 +1,6 @@
+# This is a regression test for https://github.com/CycloneDX/cyclonedx-python/issues/448
+# This file is in `cp1252` encoding - on purpose
+# This file uses CRLF for line endings - on purpose
+# some encoding specific characters: ���������������������������
+
+requirements_parser==0.2.0

From aba71056a37af9675266e10fcef193af300e970c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 12:36:32 +0100
Subject: [PATCH 023/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py          |  4 ++--
 tests/_data/requirements-duplicate.txt          |  4 ++++
 tests/_data/requirements-floating.txt           | 12 ------------
 tests/_data/requirements-local.txt              | 15 +++++++++++++--
 tests/_data/requirements-private-packages.txt   |  3 +++
 ...uirements-regression-issue448.cp1252.txt.bin |  6 ++++--
 tests/_data/requirements-url.txt                |  7 -------
 tests/_data/requirements-with-comments.txt      |  5 +++++
 tests/_data/requirements-with-hashes.txt        | 11 +++++++++++
 tests/_data/requirements-with-urls.txt          | 17 +++++++++++++++++
 .../requirements-without-pinned-versions.txt    |  3 +++
 11 files changed, 62 insertions(+), 25 deletions(-)
 create mode 100644 tests/_data/requirements-duplicate.txt
 delete mode 100644 tests/_data/requirements-floating.txt
 create mode 100644 tests/_data/requirements-private-packages.txt
 delete mode 100644 tests/_data/requirements-url.txt
 create mode 100644 tests/_data/requirements-with-comments.txt
 create mode 100644 tests/_data/requirements-with-hashes.txt
 create mode 100644 tests/_data/requirements-with-urls.txt
 create mode 100644 tests/_data/requirements-without-pinned-versions.txt

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index bdc21ea7..b7a2f28c 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -88,8 +88,8 @@ def __call__(self,  # type:ignore[override]
             download_url = requirement.link and requirement.link.url or None
             bom_ref = requirement.name or 'unknown'
             bom_refs[bom_ref] += 1
-            if bom_refs['bom_ref'] > 1:
-                bom_ref += f'-{bom_refs["bom_ref"]:x}'
+            if bom_refs[bom_ref] > 1:
+                bom_ref += f'-{bom_refs[bom_ref]:x}'
             component = Component(
                 type=ComponentType.LIBRARY,
                 name=requirement.name or 'unknown',
diff --git a/tests/_data/requirements-duplicate.txt b/tests/_data/requirements-duplicate.txt
new file mode 100644
index 00000000..323d366e
--- /dev/null
+++ b/tests/_data/requirements-duplicate.txt
@@ -0,0 +1,4 @@
+# duplicate call
+
+colorama>=0.4
+colorama==0.4.6
diff --git a/tests/_data/requirements-floating.txt b/tests/_data/requirements-floating.txt
deleted file mode 100644
index b28396fe..00000000
--- a/tests/_data/requirements-floating.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-
-# greater than
-ruamel.yaml >= 0.16
-
-# lower than
-yamale <= 3.0
-
-# no version at all
-werkzeug
-
-# from to
-click >= 7.1 , < 8.0
diff --git a/tests/_data/requirements-local.txt b/tests/_data/requirements-local.txt
index 31e77d34..37ef5bea 100644
--- a/tests/_data/requirements-local.txt
+++ b/tests/_data/requirements-local.txt
@@ -1,7 +1,18 @@
-# requirements from local path
+# local
+./myproject/chardet
+
+# local with hash
+./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804
+
+# editable install
+-e ./myproject/idna.whl
+
+# nested file -- expected to be ignored
+-r requirements-nested.txt
 
 # named
-foo @ ../foo
+foo @ file://../foo
 
 # unnamed
 ./downloads/numpy-1.9.2-cp34-none-win32.whl
+
diff --git a/tests/_data/requirements-private-packages.txt b/tests/_data/requirements-private-packages.txt
new file mode 100644
index 00000000..dca55ced
--- /dev/null
+++ b/tests/_data/requirements-private-packages.txt
@@ -0,0 +1,3 @@
+--extra-index-url https://mypi.org/simple/
+
+mypackage==1.2.3
diff --git a/tests/_data/requirements-regression-issue448.cp1252.txt.bin b/tests/_data/requirements-regression-issue448.cp1252.txt.bin
index 038e8d3f..3ae70eb8 100644
--- a/tests/_data/requirements-regression-issue448.cp1252.txt.bin
+++ b/tests/_data/requirements-regression-issue448.cp1252.txt.bin
@@ -1,6 +1,8 @@
 # This is a regression test for https://github.com/CycloneDX/cyclonedx-python/issues/448
 # This file is in `cp1252` encoding - on purpose
 # This file uses CRLF for line endings - on purpose
-# some encoding specific characters: ���������������������������
+# some encoding specific characters: ���������������������������
 
-requirements_parser==0.2.0
+packageurl-python>=0.9.4
+requirements_parser>=0.2.0
+setuptools>=50.3.2
diff --git a/tests/_data/requirements-url.txt b/tests/_data/requirements-url.txt
deleted file mode 100644
index a2794c0a..00000000
--- a/tests/_data/requirements-url.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-# requirements from VCS -- https://pip.pypa.io/en/stable/reference/requirements-file-format/#example
-
-# named
-urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip
-
-# unnamed
-http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl
diff --git a/tests/_data/requirements-with-comments.txt b/tests/_data/requirements-with-comments.txt
new file mode 100644
index 00000000..2d9c4a1a
--- /dev/null
+++ b/tests/_data/requirements-with-comments.txt
@@ -0,0 +1,5 @@
+certifi==2021.5.30 # via requests
+chardet==4.0.0 # via requests
+idna==2.10 # via requests
+requests==2.25.1 # via -r requirements.in
+urllib3==1.26.5 # via requests
\ No newline at end of file
diff --git a/tests/_data/requirements-with-hashes.txt b/tests/_data/requirements-with-hashes.txt
new file mode 100644
index 00000000..cafa282f
--- /dev/null
+++ b/tests/_data/requirements-with-hashes.txt
@@ -0,0 +1,11 @@
+# hash mode -- https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode
+
+certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8
+
+requests==2.25.1 \
+  --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804 \
+  --hash=sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e
+
+
+urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c \
+ --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098
diff --git a/tests/_data/requirements-with-urls.txt b/tests/_data/requirements-with-urls.txt
new file mode 100644
index 00000000..784fab91
--- /dev/null
+++ b/tests/_data/requirements-with-urls.txt
@@ -0,0 +1,17 @@
+
+# VCS
+## commit hash
+git+https://github.com/path/to/package-one@41b95ec#egg=package-one
+## master branch
+git+https://github.com/path/to/package-two@master#egg=package-two
+## tag
+git+https://github.com/path/to/package-three@0.1#egg=package-three
+## release tag
+git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four
+
+
+# http
+http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl
+
+# named
+urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip
diff --git a/tests/_data/requirements-without-pinned-versions.txt b/tests/_data/requirements-without-pinned-versions.txt
new file mode 100644
index 00000000..6ffd6d5c
--- /dev/null
+++ b/tests/_data/requirements-without-pinned-versions.txt
@@ -0,0 +1,3 @@
+certifi>=2021.5.30
+chardet >= 4.0.0 , < 5
+urllib3

From 85d58b8c23e136a1be4067777bfc079bc635b809 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 15:24:55 +0100
Subject: [PATCH 024/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py            |   3 +-
 cyclonedx_py/_internal/cli.py                 |   8 +-
 cyclonedx_py/_internal/pipenv.py              |   2 +-
 cyclonedx_py/_internal/poetry.py              |   2 +-
 cyclonedx_py/_internal/requirements.py        |   6 +-
 cyclonedx_py/_internal/utils/io.py            |   8 +-
 tests/__init__.py                             |  60 ++++++++
 tests/_data/{ => infiles}/.editorconfig       |   0
 tests/_data/{ => infiles}/.gitattributes      |   0
 .../{ => infiles}/requirements-duplicate.txt  |   0
 .../{ => infiles}/requirements-frozen.txt     |   0
 .../{ => infiles}/requirements-local.txt      |   0
 .../requirements-private-packages.txt         |   0
 ...rements-regression-issue448.cp1252.txt.bin |   0
 .../requirements-with-comments.txt            |   0
 .../requirements-with-hashes.txt              |   0
 .../{ => infiles}/requirements-with-urls.txt  |   0
 .../requirements-without-pinned-versions.txt  |   0
 tests/_data/snapshots/.gitattributes          |   3 +
 tests/_data/snapshots/README.md               |  13 ++
 .../requirements-duplicate.txt-1.0.xml.bin    |  17 +++
 .../requirements-duplicate.txt-1.1.xml.bin    |  15 ++
 .../requirements-duplicate.txt-1.2.json.bin   |  39 +++++
 .../requirements-duplicate.txt-1.2.xml.bin    |  28 ++++
 .../requirements-duplicate.txt-1.3.json.bin   |  39 +++++
 .../requirements-duplicate.txt-1.3.xml.bin    |  28 ++++
 .../requirements-duplicate.txt-1.4.json.bin   |  72 +++++++++
 .../requirements-duplicate.txt-1.4.xml.bin    |  53 +++++++
 .../requirements-frozen.txt-1.0.xml.bin       |  21 +++
 .../requirements-frozen.txt-1.1.xml.bin       |  19 +++
 .../requirements-frozen.txt-1.2.json.bin      |  49 ++++++
 .../requirements-frozen.txt-1.2.xml.bin       |  32 ++++
 .../requirements-frozen.txt-1.3.json.bin      |  49 ++++++
 .../requirements-frozen.txt-1.3.xml.bin       |  32 ++++
 .../requirements-frozen.txt-1.4.json.bin      |  83 ++++++++++
 .../requirements-frozen.txt-1.4.xml.bin       |  58 +++++++
 .../requirements-local.txt-1.0.xml.bin        |  35 +++++
 .../requirements-local.txt-1.1.xml.bin        |  55 +++++++
 .../requirements-local.txt-1.2.json.bin       | 102 +++++++++++++
 .../requirements-local.txt-1.2.xml.bin        |  71 +++++++++
 .../requirements-local.txt-1.3.json.bin       | 102 +++++++++++++
 .../requirements-local.txt-1.3.xml.bin        |  71 +++++++++
 .../requirements-local.txt-1.4.json.bin       | 132 ++++++++++++++++
 .../requirements-local.txt-1.4.xml.bin        |  93 +++++++++++
 ...uirements-private-packages.txt-1.0.xml.bin |  11 ++
 ...uirements-private-packages.txt-1.1.xml.bin |  10 ++
 ...irements-private-packages.txt-1.2.json.bin |  29 ++++
 ...uirements-private-packages.txt-1.2.xml.bin |  22 +++
 ...irements-private-packages.txt-1.3.json.bin |  29 ++++
 ...uirements-private-packages.txt-1.3.xml.bin |  22 +++
 ...irements-private-packages.txt-1.4.json.bin |  63 ++++++++
 ...uirements-private-packages.txt-1.4.xml.bin |  48 ++++++
 ...ession-issue448.cp1252.txt.bin-1.0.xml.bin |  23 +++
 ...ession-issue448.cp1252.txt.bin-1.1.xml.bin |  20 +++
 ...ssion-issue448.cp1252.txt.bin-1.2.json.bin |  49 ++++++
 ...ession-issue448.cp1252.txt.bin-1.2.xml.bin |  34 +++++
 ...ssion-issue448.cp1252.txt.bin-1.3.json.bin |  49 ++++++
 ...ession-issue448.cp1252.txt.bin-1.3.xml.bin |  34 +++++
 ...ssion-issue448.cp1252.txt.bin-1.4.json.bin |  80 ++++++++++
 ...ession-issue448.cp1252.txt.bin-1.4.xml.bin |  57 +++++++
 ...requirements-with-comments.txt-1.0.xml.bin |  35 +++++
 ...requirements-with-comments.txt-1.1.xml.bin |  30 ++++
 ...equirements-with-comments.txt-1.2.json.bin |  69 +++++++++
 ...requirements-with-comments.txt-1.2.xml.bin |  46 ++++++
 ...equirements-with-comments.txt-1.3.json.bin |  69 +++++++++
 ...requirements-with-comments.txt-1.3.xml.bin |  46 ++++++
 ...equirements-with-comments.txt-1.4.json.bin | 103 +++++++++++++
 ...requirements-with-comments.txt-1.4.xml.bin |  72 +++++++++
 .../requirements-with-hashes.txt-1.0.xml.bin  |  35 +++++
 .../requirements-with-hashes.txt-1.1.xml.bin  |  32 ++++
 .../requirements-with-hashes.txt-1.2.json.bin |  79 ++++++++++
 .../requirements-with-hashes.txt-1.2.xml.bin  |  46 ++++++
 .../requirements-with-hashes.txt-1.3.json.bin |  79 ++++++++++
 .../requirements-with-hashes.txt-1.3.xml.bin  |  46 ++++++
 .../requirements-with-hashes.txt-1.4.json.bin | 113 ++++++++++++++
 .../requirements-with-hashes.txt-1.4.xml.bin  |  72 +++++++++
 .../requirements-with-urls.txt-1.0.xml.bin    |  41 +++++
 .../requirements-with-urls.txt-1.1.xml.bin    |  65 ++++++++
 .../requirements-with-urls.txt-1.2.json.bin   | 115 ++++++++++++++
 .../requirements-with-urls.txt-1.2.xml.bin    |  82 ++++++++++
 .../requirements-with-urls.txt-1.3.json.bin   | 115 ++++++++++++++
 .../requirements-with-urls.txt-1.3.xml.bin    |  82 ++++++++++
 .../requirements-with-urls.txt-1.4.json.bin   | 144 ++++++++++++++++++
 .../requirements-with-urls.txt-1.4.xml.bin    | 103 +++++++++++++
 ...ts-without-pinned-versions.txt-1.0.xml.bin |  23 +++
 ...ts-without-pinned-versions.txt-1.1.xml.bin |  20 +++
 ...s-without-pinned-versions.txt-1.2.json.bin |  49 ++++++
 ...ts-without-pinned-versions.txt-1.2.xml.bin |  34 +++++
 ...s-without-pinned-versions.txt-1.3.json.bin |  49 ++++++
 ...ts-without-pinned-versions.txt-1.3.xml.bin |  34 +++++
 ...s-without-pinned-versions.txt-1.4.json.bin |  80 ++++++++++
 ...ts-without-pinned-versions.txt-1.4.xml.bin |  57 +++++++
 tests/integration/__init__.py                 |  16 ++
 tests/integration/test_requirements.py        |  72 +++++++++
 94 files changed, 4119 insertions(+), 14 deletions(-)
 create mode 100644 tests/__init__.py
 rename tests/_data/{ => infiles}/.editorconfig (100%)
 rename tests/_data/{ => infiles}/.gitattributes (100%)
 rename tests/_data/{ => infiles}/requirements-duplicate.txt (100%)
 rename tests/_data/{ => infiles}/requirements-frozen.txt (100%)
 rename tests/_data/{ => infiles}/requirements-local.txt (100%)
 rename tests/_data/{ => infiles}/requirements-private-packages.txt (100%)
 rename tests/_data/{ => infiles}/requirements-regression-issue448.cp1252.txt.bin (100%)
 rename tests/_data/{ => infiles}/requirements-with-comments.txt (100%)
 rename tests/_data/{ => infiles}/requirements-with-hashes.txt (100%)
 rename tests/_data/{ => infiles}/requirements-with-urls.txt (100%)
 rename tests/_data/{ => infiles}/requirements-without-pinned-versions.txt (100%)
 create mode 100644 tests/_data/snapshots/.gitattributes
 create mode 100644 tests/_data/snapshots/README.md
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin
 create mode 100644 tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin
 create mode 100644 tests/integration/__init__.py
 create mode 100644 tests/integration/test_requirements.py

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 7762969f..5a51cc40 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -19,7 +19,7 @@
 from abc import ABC, abstractmethod
 from typing import TYPE_CHECKING, Any
 
-if TYPE_CHECKING:
+if TYPE_CHECKING:  # pragma: no cover
     from argparse import ArgumentParser
     from logging import Logger
 
@@ -27,6 +27,7 @@
 
 
 class BomBuilder(ABC):
+
     @staticmethod
     @abstractmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 20a777a5..f55695c6 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -17,7 +17,7 @@
 
 import sys
 from argparse import ArgumentParser, ArgumentTypeError, FileType, RawDescriptionHelpFormatter
-from typing import TYPE_CHECKING, Any, Dict, Optional, TextIO, Type
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, TextIO, Type
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
 
@@ -26,7 +26,7 @@
 from .poetry import PoetryBB
 from .requirements import RequirementsBB
 
-if TYPE_CHECKING:
+if TYPE_CHECKING:  # pragma: no cover
     from argparse import Action
     from logging import Logger
 
@@ -192,7 +192,7 @@ def __call__(self,
         self.write(output, outfile)
 
 
-def main(**kwargs: Any) -> int:
+def main(*, args: Optional[List[str]] = None, **kwargs: Any) -> int:
     import logging
     from sys import stderr
 
@@ -204,7 +204,7 @@ def main(**kwargs: Any) -> int:
                         default=0)
     arg_parser = Command.make_argument_parser(sco=arg_co, **kwargs)
     del arg_co
-    args = vars(arg_parser.parse_args())
+    args = vars(arg_parser.parse_args(args))
 
     if args['command'] is None:
         arg_parser.print_help()
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 377431b7..1ed805cb 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -20,7 +20,7 @@
 
 from . import BomBuilder
 
-if TYPE_CHECKING:
+if TYPE_CHECKING:  # pragma: no cover
     from argparse import ArgumentParser
     from logging import Logger
 
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 065c45c4..b37b8012 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -20,7 +20,7 @@
 
 from . import BomBuilder
 
-if TYPE_CHECKING:
+if TYPE_CHECKING:  # pragma: no cover
     from argparse import ArgumentParser
     from logging import Logger
 
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index b7a2f28c..639ae3fd 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -20,7 +20,7 @@
 
 from . import BomBuilder
 
-if TYPE_CHECKING:
+if TYPE_CHECKING:  # pragma: no cover
     from argparse import ArgumentParser
     from logging import Logger
 
@@ -75,13 +75,13 @@ def __call__(self,  # type:ignore[override]
         from packageurl import PackageURL
         from pip_requirements_parser import RequirementsFile
 
-        from .utils.io import io2file
+        from .utils.io import io2textfile
 
         bom = Bom()
         bom_refs = Counter()
 
         # no support for `include_nested` intended, so a temp file instead the original path is fine
-        with io2file(infile) as ff:
+        with io2textfile(infile) as ff:
             requirements = RequirementsFile.from_file(ff.name, include_nested=False).requirements
         for requirement in requirements:
             version = requirement.get_pinned_version or None
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index 07df367e..951c65c0 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -21,7 +21,7 @@
 
 from chardet import detect as chardetect
 
-if TYPE_CHECKING:
+if TYPE_CHECKING:  # pragma: no cover
     from tempfile import _TemporaryFileWrapper
 
 
@@ -33,8 +33,8 @@ def io2str(io: BinaryIO) -> str:
     return data.decode(encoding)
 
 
-def io2file(io: BinaryIO) -> '_TemporaryFileWrapper':
-    tf = NamedTemporaryFile('wb')
-    tf.write(io.read())
+def io2textfile(io: BinaryIO) -> '_TemporaryFileWrapper':
+    tf = NamedTemporaryFile('wt', encoding='utf8')
+    tf.write(io2str(io))
     tf.flush()
     return tf
diff --git a/tests/__init__.py b/tests/__init__.py
new file mode 100644
index 00000000..3855b8dd
--- /dev/null
+++ b/tests/__init__.py
@@ -0,0 +1,60 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from os import getenv
+from os.path import dirname, join
+from typing import Union
+from unittest import TestCase
+
+_TESTDATA_DIRECTORY = join(dirname(__file__), '_data')
+
+INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
+SNAPSHOTS_DIRECTORY = join(_TESTDATA_DIRECTORY, 'snapshots')
+
+RECREATE_SNAPSHOTS = '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
+if RECREATE_SNAPSHOTS:
+    print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
+
+
+class SnapshotMixin:
+
+    @staticmethod
+    def getSnapshotFile(snapshot_name: str) -> str:  # noqa: N802
+        return join(SNAPSHOTS_DIRECTORY, f'{snapshot_name}.bin')
+
+    @classmethod
+    def writeSnapshot(cls, snapshot_name: str, data: str) -> None:  # noqa: N802
+        with open(cls.getSnapshotFile(snapshot_name), 'w') as s:
+            s.write(data)
+
+    @classmethod
+    def readSnapshot(cls, snapshot_name: str) -> str:  # noqa: N802
+        with open(cls.getSnapshotFile(snapshot_name), 'r') as s:
+            return s.read()
+
+    def assertEqualSnapshot(self: Union[TestCase, 'SnapshotMixin'],  # noqa: N802
+                            actual: str, snapshot_name: str) -> None:
+        if RECREATE_SNAPSHOTS:
+            self.writeSnapshot(snapshot_name, actual)
+        _omd = self.maxDiff
+        _omd = self.maxDiff
+        self.maxDiff = None
+        try:
+            self.assertEqual(actual, self.readSnapshot(snapshot_name))
+        finally:
+            self.maxDiff = _omd
diff --git a/tests/_data/.editorconfig b/tests/_data/infiles/.editorconfig
similarity index 100%
rename from tests/_data/.editorconfig
rename to tests/_data/infiles/.editorconfig
diff --git a/tests/_data/.gitattributes b/tests/_data/infiles/.gitattributes
similarity index 100%
rename from tests/_data/.gitattributes
rename to tests/_data/infiles/.gitattributes
diff --git a/tests/_data/requirements-duplicate.txt b/tests/_data/infiles/requirements-duplicate.txt
similarity index 100%
rename from tests/_data/requirements-duplicate.txt
rename to tests/_data/infiles/requirements-duplicate.txt
diff --git a/tests/_data/requirements-frozen.txt b/tests/_data/infiles/requirements-frozen.txt
similarity index 100%
rename from tests/_data/requirements-frozen.txt
rename to tests/_data/infiles/requirements-frozen.txt
diff --git a/tests/_data/requirements-local.txt b/tests/_data/infiles/requirements-local.txt
similarity index 100%
rename from tests/_data/requirements-local.txt
rename to tests/_data/infiles/requirements-local.txt
diff --git a/tests/_data/requirements-private-packages.txt b/tests/_data/infiles/requirements-private-packages.txt
similarity index 100%
rename from tests/_data/requirements-private-packages.txt
rename to tests/_data/infiles/requirements-private-packages.txt
diff --git a/tests/_data/requirements-regression-issue448.cp1252.txt.bin b/tests/_data/infiles/requirements-regression-issue448.cp1252.txt.bin
similarity index 100%
rename from tests/_data/requirements-regression-issue448.cp1252.txt.bin
rename to tests/_data/infiles/requirements-regression-issue448.cp1252.txt.bin
diff --git a/tests/_data/requirements-with-comments.txt b/tests/_data/infiles/requirements-with-comments.txt
similarity index 100%
rename from tests/_data/requirements-with-comments.txt
rename to tests/_data/infiles/requirements-with-comments.txt
diff --git a/tests/_data/requirements-with-hashes.txt b/tests/_data/infiles/requirements-with-hashes.txt
similarity index 100%
rename from tests/_data/requirements-with-hashes.txt
rename to tests/_data/infiles/requirements-with-hashes.txt
diff --git a/tests/_data/requirements-with-urls.txt b/tests/_data/infiles/requirements-with-urls.txt
similarity index 100%
rename from tests/_data/requirements-with-urls.txt
rename to tests/_data/infiles/requirements-with-urls.txt
diff --git a/tests/_data/requirements-without-pinned-versions.txt b/tests/_data/infiles/requirements-without-pinned-versions.txt
similarity index 100%
rename from tests/_data/requirements-without-pinned-versions.txt
rename to tests/_data/infiles/requirements-without-pinned-versions.txt
diff --git a/tests/_data/snapshots/.gitattributes b/tests/_data/snapshots/.gitattributes
new file mode 100644
index 00000000..cb164e3d
--- /dev/null
+++ b/tests/_data/snapshots/.gitattributes
@@ -0,0 +1,3 @@
+# files are compared bype-wise, so they need to be treated as binary
+xml/**      linguist-generated binary diff=xml
+json/**     linguist-generated binary diff=json
diff --git a/tests/_data/snapshots/README.md b/tests/_data/snapshots/README.md
new file mode 100644
index 00000000..f9743244
--- /dev/null
+++ b/tests/_data/snapshots/README.md
@@ -0,0 +1,13 @@
+# TEST FIXTURES
+
+## RE-CREATION
+
+Some assets here can be (re-)created automatically, by setting the env var `CDX_TEST_RECREATE_SNAPSHOTS=1`.  
+It might also help to set `PYTHONHASHSEED=0`!  
+As a shortcut just run:
+
+```shell
+CDX_TEST_RECREATE_SNAPSHOTS=1 poetry run tox -e py
+```
+
+The files will be written as is, which might not be human-readable. feel free to reformat the files manually.
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin
new file mode 100644
index 00000000..890ce8ca
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version/>
+      <purl>pkg:pypi/colorama</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin
new file mode 100644
index 00000000..2fc9b1c2
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin
@@ -0,0 +1,15 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="colorama-2">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <version/>
+      <purl>pkg:pypi/colorama</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin
new file mode 100644
index 00000000..bdf1e0b2
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin
@@ -0,0 +1,39 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama-2",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "colorama",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama"
+    },
+    {
+      "ref": "colorama-2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin
new file mode 100644
index 00000000..894fcc3a
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama-2">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <version/>
+      <purl>pkg:pypi/colorama</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama"/>
+    <dependency ref="colorama-2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin
new file mode 100644
index 00000000..b90c2147
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin
@@ -0,0 +1,39 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama-2",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "colorama",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama"
+    },
+    {
+      "ref": "colorama-2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin
new file mode 100644
index 00000000..d82e4472
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama-2">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <version/>
+      <purl>pkg:pypi/colorama</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama"/>
+    <dependency ref="colorama-2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin
new file mode 100644
index 00000000..15d06171
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin
@@ -0,0 +1,72 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama-2",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "colorama",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama"
+    },
+    {
+      "ref": "colorama-2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin
new file mode 100644
index 00000000..f7d294c5
--- /dev/null
+++ b/tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama-2">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <purl>pkg:pypi/colorama</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama"/>
+    <dependency ref="colorama-2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.0.xml.bin
new file mode 100644
index 00000000..17420085
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.0.xml.bin
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.1.xml.bin
new file mode 100644
index 00000000..8bbfc7ae
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.1.xml.bin
@@ -0,0 +1,19 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="FooProject">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin b/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin
new file mode 100644
index 00000000..1b19c0a5
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin
@@ -0,0 +1,49 @@
+{
+  "components": [
+    {
+      "bom-ref": "FooProject",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "colorama",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "FooProject"
+    },
+    {
+      "ref": "colorama"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin
new file mode 100644
index 00000000..528eda45
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin
@@ -0,0 +1,32 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="FooProject">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="FooProject"/>
+    <dependency ref="colorama"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin b/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin
new file mode 100644
index 00000000..d6601eac
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin
@@ -0,0 +1,49 @@
+{
+  "components": [
+    {
+      "bom-ref": "FooProject",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "colorama",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "FooProject"
+    },
+    {
+      "ref": "colorama"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin
new file mode 100644
index 00000000..89d27cc4
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin
@@ -0,0 +1,32 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="FooProject">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="FooProject"/>
+    <dependency ref="colorama"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin b/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin
new file mode 100644
index 00000000..343a49e4
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin
@@ -0,0 +1,83 @@
+{
+  "components": [
+    {
+      "bom-ref": "FooProject",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "colorama",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "FooProject"
+    },
+    {
+      "ref": "colorama"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin
new file mode 100644
index 00000000..c555cbbc
--- /dev/null
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin
@@ -0,0 +1,58 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="FooProject">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="colorama">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="FooProject"/>
+    <dependency ref="colorama"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.0.xml.bin
new file mode 100644
index 00000000..1fd12895
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.0.xml.bin
@@ -0,0 +1,35 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>foo</name>
+      <version/>
+      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
new file mode 100644
index 00000000..ed599657
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
@@ -0,0 +1,55 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="foo">
+      <name>foo</name>
+      <version/>
+      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://../foo</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown">
+      <name>unknown</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/chardet</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-2">
+      <name>unknown</name>
+      <version/>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/requests</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-3">
+      <name>unknown</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/idna.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.json.bin b/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
new file mode 100644
index 00000000..d5ca940d
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
@@ -0,0 +1,102 @@
+{
+  "components": [
+    {
+      "bom-ref": "foo",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "file://../foo"
+        }
+      ],
+      "name": "foo",
+      "purl": "pkg:pypi/foo?download_url=file://../foo",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "numpy",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "unknown",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/chardet"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "unknown-2",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/requests"
+        }
+      ],
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "unknown-3",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "foo"
+    },
+    {
+      "ref": "numpy"
+    },
+    {
+      "ref": "unknown"
+    },
+    {
+      "ref": "unknown-2"
+    },
+    {
+      "ref": "unknown-3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
new file mode 100644
index 00000000..46d1e9c5
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
@@ -0,0 +1,71 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="foo">
+      <name>foo</name>
+      <version/>
+      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://../foo</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown">
+      <name>unknown</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/chardet</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-2">
+      <name>unknown</name>
+      <version/>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/requests</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-3">
+      <name>unknown</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/idna.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="foo"/>
+    <dependency ref="numpy"/>
+    <dependency ref="unknown"/>
+    <dependency ref="unknown-2"/>
+    <dependency ref="unknown-3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.json.bin b/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
new file mode 100644
index 00000000..beceb00b
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
@@ -0,0 +1,102 @@
+{
+  "components": [
+    {
+      "bom-ref": "foo",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "file://../foo"
+        }
+      ],
+      "name": "foo",
+      "purl": "pkg:pypi/foo?download_url=file://../foo",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "numpy",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "unknown",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/chardet"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "unknown-2",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/requests"
+        }
+      ],
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "unknown-3",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "foo"
+    },
+    {
+      "ref": "numpy"
+    },
+    {
+      "ref": "unknown"
+    },
+    {
+      "ref": "unknown-2"
+    },
+    {
+      "ref": "unknown-3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
new file mode 100644
index 00000000..e56a7519
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
@@ -0,0 +1,71 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="foo">
+      <name>foo</name>
+      <version/>
+      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://../foo</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown">
+      <name>unknown</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/chardet</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-2">
+      <name>unknown</name>
+      <version/>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/requests</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-3">
+      <name>unknown</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/idna.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="foo"/>
+    <dependency ref="numpy"/>
+    <dependency ref="unknown"/>
+    <dependency ref="unknown-2"/>
+    <dependency ref="unknown-3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.json.bin b/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
new file mode 100644
index 00000000..daac62a7
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
@@ -0,0 +1,132 @@
+{
+  "components": [
+    {
+      "bom-ref": "foo",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "file://../foo"
+        }
+      ],
+      "name": "foo",
+      "purl": "pkg:pypi/foo?download_url=file://../foo",
+      "type": "library"
+    },
+    {
+      "bom-ref": "numpy",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "unknown",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/chardet"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "unknown-2",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/requests"
+        }
+      ],
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "unknown-3",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "foo"
+    },
+    {
+      "ref": "numpy"
+    },
+    {
+      "ref": "unknown"
+    },
+    {
+      "ref": "unknown-2"
+    },
+    {
+      "ref": "unknown-3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
new file mode 100644
index 00000000..328cfd24
--- /dev/null
+++ b/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
@@ -0,0 +1,93 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="foo">
+      <name>foo</name>
+      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://../foo</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown">
+      <name>unknown</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/chardet</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-2">
+      <name>unknown</name>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/requests</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="unknown-3">
+      <name>unknown</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>./myproject/idna.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="foo"/>
+    <dependency ref="numpy"/>
+    <dependency ref="unknown"/>
+    <dependency ref="unknown-2"/>
+    <dependency ref="unknown-3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.0.xml.bin
new file mode 100644
index 00000000..d411ecbb
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.0.xml.bin
@@ -0,0 +1,11 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.1.xml.bin
new file mode 100644
index 00000000..d8c8a3ae
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.1.xml.bin
@@ -0,0 +1,10 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="mypackage">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin
new file mode 100644
index 00000000..89484ccc
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin
@@ -0,0 +1,29 @@
+{
+  "components": [
+    {
+      "bom-ref": "mypackage",
+      "name": "mypackage",
+      "purl": "pkg:pypi/mypackage@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "mypackage"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin
new file mode 100644
index 00000000..67c178af
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin
@@ -0,0 +1,22 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="mypackage">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="mypackage"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin
new file mode 100644
index 00000000..15fc3c72
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin
@@ -0,0 +1,29 @@
+{
+  "components": [
+    {
+      "bom-ref": "mypackage",
+      "name": "mypackage",
+      "purl": "pkg:pypi/mypackage@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "mypackage"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin
new file mode 100644
index 00000000..42755fe2
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin
@@ -0,0 +1,22 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="mypackage">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="mypackage"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin
new file mode 100644
index 00000000..77ba7318
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin
@@ -0,0 +1,63 @@
+{
+  "components": [
+    {
+      "bom-ref": "mypackage",
+      "name": "mypackage",
+      "purl": "pkg:pypi/mypackage@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "mypackage"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin
new file mode 100644
index 00000000..b8d08244
--- /dev/null
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin
@@ -0,0 +1,48 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="mypackage">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="mypackage"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.0.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.0.xml.bin
new file mode 100644
index 00000000..1ad2c86c
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version/>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>requirements_parser</name>
+      <version/>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>setuptools</name>
+      <version/>
+      <purl>pkg:pypi/setuptools</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.1.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.1.xml.bin
new file mode 100644
index 00000000..a7b87c4a
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.1.xml.bin
@@ -0,0 +1,20 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="packageurl-python">
+      <name>packageurl-python</name>
+      <version/>
+      <purl>pkg:pypi/packageurl-python</purl>
+    </component>
+    <component type="library" bom-ref="requirements_parser">
+      <name>requirements_parser</name>
+      <version/>
+      <purl>pkg:pypi/requirements-parser</purl>
+    </component>
+    <component type="library" bom-ref="setuptools">
+      <name>setuptools</name>
+      <version/>
+      <purl>pkg:pypi/setuptools</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin
new file mode 100644
index 00000000..0aa8bd15
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin
@@ -0,0 +1,49 @@
+{
+  "components": [
+    {
+      "bom-ref": "packageurl-python",
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements_parser",
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "setuptools",
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "packageurl-python"
+    },
+    {
+      "ref": "requirements_parser"
+    },
+    {
+      "ref": "setuptools"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin
new file mode 100644
index 00000000..023e6627
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin
@@ -0,0 +1,34 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="packageurl-python">
+      <name>packageurl-python</name>
+      <version/>
+      <purl>pkg:pypi/packageurl-python</purl>
+    </component>
+    <component type="library" bom-ref="requirements_parser">
+      <name>requirements_parser</name>
+      <version/>
+      <purl>pkg:pypi/requirements-parser</purl>
+    </component>
+    <component type="library" bom-ref="setuptools">
+      <name>setuptools</name>
+      <version/>
+      <purl>pkg:pypi/setuptools</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="packageurl-python"/>
+    <dependency ref="requirements_parser"/>
+    <dependency ref="setuptools"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin
new file mode 100644
index 00000000..f5df8e64
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin
@@ -0,0 +1,49 @@
+{
+  "components": [
+    {
+      "bom-ref": "packageurl-python",
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements_parser",
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "setuptools",
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "packageurl-python"
+    },
+    {
+      "ref": "requirements_parser"
+    },
+    {
+      "ref": "setuptools"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin
new file mode 100644
index 00000000..98cc41d8
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin
@@ -0,0 +1,34 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="packageurl-python">
+      <name>packageurl-python</name>
+      <version/>
+      <purl>pkg:pypi/packageurl-python</purl>
+    </component>
+    <component type="library" bom-ref="requirements_parser">
+      <name>requirements_parser</name>
+      <version/>
+      <purl>pkg:pypi/requirements-parser</purl>
+    </component>
+    <component type="library" bom-ref="setuptools">
+      <name>setuptools</name>
+      <version/>
+      <purl>pkg:pypi/setuptools</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="packageurl-python"/>
+    <dependency ref="requirements_parser"/>
+    <dependency ref="setuptools"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin
new file mode 100644
index 00000000..7436db91
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin
@@ -0,0 +1,80 @@
+{
+  "components": [
+    {
+      "bom-ref": "packageurl-python",
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements_parser",
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library"
+    },
+    {
+      "bom-ref": "setuptools",
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "packageurl-python"
+    },
+    {
+      "ref": "requirements_parser"
+    },
+    {
+      "ref": "setuptools"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin
new file mode 100644
index 00000000..0514be57
--- /dev/null
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin
@@ -0,0 +1,57 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="packageurl-python">
+      <name>packageurl-python</name>
+      <purl>pkg:pypi/packageurl-python</purl>
+    </component>
+    <component type="library" bom-ref="requirements_parser">
+      <name>requirements_parser</name>
+      <purl>pkg:pypi/requirements-parser</purl>
+    </component>
+    <component type="library" bom-ref="setuptools">
+      <name>setuptools</name>
+      <purl>pkg:pypi/setuptools</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="packageurl-python"/>
+    <dependency ref="requirements_parser"/>
+    <dependency ref="setuptools"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.0.xml.bin
new file mode 100644
index 00000000..4e37b13f
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.0.xml.bin
@@ -0,0 +1,35 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>2.10</version>
+      <purl>pkg:pypi/idna@2.10</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.1.xml.bin
new file mode 100644
index 00000000..45c0ff12
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.1.xml.bin
@@ -0,0 +1,30 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="idna">
+      <name>idna</name>
+      <version>2.10</version>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin
new file mode 100644
index 00000000..9287722b
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin
@@ -0,0 +1,69 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "chardet",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "idna",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requests",
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "chardet"
+    },
+    {
+      "ref": "idna"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin
new file mode 100644
index 00000000..321794a7
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin
@@ -0,0 +1,46 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="idna">
+      <name>idna</name>
+      <version>2.10</version>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="chardet"/>
+    <dependency ref="idna"/>
+    <dependency ref="requests"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin
new file mode 100644
index 00000000..e78b8104
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin
@@ -0,0 +1,69 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "chardet",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "idna",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requests",
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "chardet"
+    },
+    {
+      "ref": "idna"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin
new file mode 100644
index 00000000..7b18fac2
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin
@@ -0,0 +1,46 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="idna">
+      <name>idna</name>
+      <version>2.10</version>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="chardet"/>
+    <dependency ref="idna"/>
+    <dependency ref="requests"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin
new file mode 100644
index 00000000..9e56efc1
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin
@@ -0,0 +1,103 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "chardet",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "idna",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requests",
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "chardet"
+    },
+    {
+      "ref": "idna"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin
new file mode 100644
index 00000000..2fb96e0c
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin
@@ -0,0 +1,72 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="idna">
+      <name>idna</name>
+      <version>2.10</version>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="chardet"/>
+    <dependency ref="idna"/>
+    <dependency ref="requests"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.0.xml.bin
new file mode 100644
index 00000000..ab156af4
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.0.xml.bin
@@ -0,0 +1,35 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
+      </hashes>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.1.xml.bin
new file mode 100644
index 00000000..a6132456
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.1.xml.bin
@@ -0,0 +1,32 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
+      </hashes>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin
new file mode 100644
index 00000000..6775d778
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin
@@ -0,0 +1,79 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requests",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+        }
+      ],
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "urllib3",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin
new file mode 100644
index 00000000..998d991c
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin
@@ -0,0 +1,46 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
+      </hashes>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="requests"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin
new file mode 100644
index 00000000..28566ef0
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin
@@ -0,0 +1,79 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requests",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+        }
+      ],
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "urllib3",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin
new file mode 100644
index 00000000..72ae9f25
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin
@@ -0,0 +1,46 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
+      </hashes>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="requests"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin
new file mode 100644
index 00000000..2e361d73
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin
@@ -0,0 +1,113 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requests",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+        }
+      ],
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "urllib3",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin
new file mode 100644
index 00000000..ac51fb63
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin
@@ -0,0 +1,72 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
+      </hashes>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="requests"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.0.xml.bin
new file mode 100644
index 00000000..bee58c95
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.0.xml.bin
@@ -0,0 +1,41 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>package-four</name>
+      <version/>
+      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-one</name>
+      <version/>
+      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-three</name>
+      <version/>
+      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-two</name>
+      <version/>
+      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.1.xml.bin
new file mode 100644
index 00000000..8ce64d86
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.1.xml.bin
@@ -0,0 +1,65 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="package-four">
+      <name>package-four</name>
+      <version/>
+      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-one">
+      <name>package-one</name>
+      <version/>
+      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-three">
+      <name>package-three</name>
+      <version/>
+      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-two">
+      <name>package-two</name>
+      <version/>
+      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython-Phoenix">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin
new file mode 100644
index 00000000..fbc9b5b0
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin
@@ -0,0 +1,115 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-four",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-one",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-three",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-two",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "urllib3",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "wxPython-Phoenix",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-four"
+    },
+    {
+      "ref": "package-one"
+    },
+    {
+      "ref": "package-three"
+    },
+    {
+      "ref": "package-two"
+    },
+    {
+      "ref": "urllib3"
+    },
+    {
+      "ref": "wxPython-Phoenix"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin
new file mode 100644
index 00000000..e00d98c2
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin
@@ -0,0 +1,82 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-four">
+      <name>package-four</name>
+      <version/>
+      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-one">
+      <name>package-one</name>
+      <version/>
+      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-three">
+      <name>package-three</name>
+      <version/>
+      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-two">
+      <name>package-two</name>
+      <version/>
+      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython-Phoenix">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-four"/>
+    <dependency ref="package-one"/>
+    <dependency ref="package-three"/>
+    <dependency ref="package-two"/>
+    <dependency ref="urllib3"/>
+    <dependency ref="wxPython-Phoenix"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin
new file mode 100644
index 00000000..f515c684
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin
@@ -0,0 +1,115 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-four",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-one",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-three",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-two",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "urllib3",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "wxPython-Phoenix",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-four"
+    },
+    {
+      "ref": "package-one"
+    },
+    {
+      "ref": "package-three"
+    },
+    {
+      "ref": "package-two"
+    },
+    {
+      "ref": "urllib3"
+    },
+    {
+      "ref": "wxPython-Phoenix"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin
new file mode 100644
index 00000000..4b44b428
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin
@@ -0,0 +1,82 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-four">
+      <name>package-four</name>
+      <version/>
+      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-one">
+      <name>package-one</name>
+      <version/>
+      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-three">
+      <name>package-three</name>
+      <version/>
+      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-two">
+      <name>package-two</name>
+      <version/>
+      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython-Phoenix">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-four"/>
+    <dependency ref="package-one"/>
+    <dependency ref="package-three"/>
+    <dependency ref="package-two"/>
+    <dependency ref="urllib3"/>
+    <dependency ref="wxPython-Phoenix"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin
new file mode 100644
index 00000000..3e87bfd3
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin
@@ -0,0 +1,144 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-four",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library"
+    },
+    {
+      "bom-ref": "package-one",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library"
+    },
+    {
+      "bom-ref": "package-three",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library"
+    },
+    {
+      "bom-ref": "package-two",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library"
+    },
+    {
+      "bom-ref": "urllib3",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library"
+    },
+    {
+      "bom-ref": "wxPython-Phoenix",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-four"
+    },
+    {
+      "ref": "package-one"
+    },
+    {
+      "ref": "package-three"
+    },
+    {
+      "ref": "package-two"
+    },
+    {
+      "ref": "urllib3"
+    },
+    {
+      "ref": "wxPython-Phoenix"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin
new file mode 100644
index 00000000..89369d76
--- /dev/null
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin
@@ -0,0 +1,103 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-four">
+      <name>package-four</name>
+      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-one">
+      <name>package-one</name>
+      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-three">
+      <name>package-three</name>
+      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-two">
+      <name>package-two</name>
+      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython-Phoenix">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-four"/>
+    <dependency ref="package-one"/>
+    <dependency ref="package-three"/>
+    <dependency ref="package-two"/>
+    <dependency ref="urllib3"/>
+    <dependency ref="wxPython-Phoenix"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.0.xml.bin
new file mode 100644
index 00000000..9c95e3c2
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>certifi</name>
+      <version/>
+      <purl>pkg:pypi/certifi</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>chardet</name>
+      <version/>
+      <purl>pkg:pypi/chardet</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.1.xml.bin
new file mode 100644
index 00000000..dd3b4825
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.1.xml.bin
@@ -0,0 +1,20 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version/>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <version/>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin
new file mode 100644
index 00000000..4bd61884
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin
@@ -0,0 +1,49 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "chardet",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "chardet"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin
new file mode 100644
index 00000000..7b1b07ba
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin
@@ -0,0 +1,34 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version/>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <version/>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="chardet"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin
new file mode 100644
index 00000000..b6c55384
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin
@@ -0,0 +1,49 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "chardet",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "chardet"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin
new file mode 100644
index 00000000..498cc0e2
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin
@@ -0,0 +1,34 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <version/>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <version/>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="chardet"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin
new file mode 100644
index 00000000..caf7a3c4
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin
@@ -0,0 +1,80 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library"
+    },
+    {
+      "bom-ref": "chardet",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library"
+    },
+    {
+      "bom-ref": "urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi"
+    },
+    {
+      "ref": "chardet"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://cyclonedx.org"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.0.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin
new file mode 100644
index 00000000..c6b1c537
--- /dev/null
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin
@@ -0,0 +1,57 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.0.1</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://cyclonedx.org</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi">
+      <name>certifi</name>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="chardet">
+      <name>chardet</name>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi"/>
+    <dependency ref="chardet"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/integration/__init__.py b/tests/integration/__init__.py
new file mode 100644
index 00000000..c2926fb2
--- /dev/null
+++ b/tests/integration/__init__.py
@@ -0,0 +1,16 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
new file mode 100644
index 00000000..44fdd304
--- /dev/null
+++ b/tests/integration/test_requirements.py
@@ -0,0 +1,72 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+import re
+from contextlib import redirect_stderr, redirect_stdout
+from glob import glob
+from io import StringIO
+from os.path import basename, join
+from unittest import TestCase
+
+from cyclonedx.schema import OutputFormat, SchemaVersion
+from ddt import ddt, named_data
+
+from cyclonedx_py._internal.cli import main
+from tests import INFILES_DIRECTORY, SnapshotMixin
+
+files = glob(join(INFILES_DIRECTORY, 'requirements-*'))
+unsupported_of_sf = [
+    (OutputFormat.JSON, SchemaVersion.V1_1),
+    (OutputFormat.JSON, SchemaVersion.V1_0),
+]
+
+
+@ddt
+class TestRequirements(TestCase, SnapshotMixin):
+
+    @named_data(*(
+        [f'{basename(file)}-{sv.name}-{of.name}', file, sv, of]
+        for file in files
+        for sv in SchemaVersion
+        for of in OutputFormat
+        if (of, sv) not in unsupported_of_sf
+    ))
+    def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = 'fakeerr'
+            out.name = 'fakeout'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = main(args=[
+                    'requirements',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    infile])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            self._make_reproducible(out, of),
+            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}')
+
+    __REPR_SUB_PATTERN = {
+        OutputFormat.JSON: re.compile(r'\s*"(?:timestamp|serialNumber)":\s*".*?",?'),
+        OutputFormat.XML: re.compile(r'\s*<timestamp>.*?</timestamp>| serialNumber=".*?"'),
+    }
+
+    def _make_reproducible(self, value: str, of: OutputFormat) -> str:
+        return self.__REPR_SUB_PATTERN[of].sub('', value)

From a44ff753a516d41e5d7233828fd2951eee1c1f04 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 15:42:02 +0100
Subject: [PATCH 025/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py     | 8 ++++----
 cyclonedx_py/_internal/pipenv.py       | 4 ++--
 cyclonedx_py/_internal/poetry.py       | 4 ++--
 cyclonedx_py/_internal/requirements.py | 4 ++--
 cyclonedx_py/_internal/utils/io.py     | 2 +-
 tests/integration/test_requirements.py | 2 ++
 6 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 5a51cc40..55d1df82 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -30,15 +30,15 @@ class BomBuilder(ABC):
 
     @staticmethod
     @abstractmethod
-    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
+    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':  # pragma: no cover
         ...
 
     @abstractmethod
-    def __init__(self,
+    def __init__(self, *,
                  logger: 'Logger',
-                 **kwargs: Any) -> None:
+                 **kwargs: Any) -> None:  # pragma: no cover
         ...
 
     @abstractmethod
-    def __call__(self, **kwargs: Any) -> 'Bom':
+    def __call__(self, **kwargs: Any) -> 'Bom':  # pragma: no cover
         ...
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 1ed805cb..bf66cebb 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -46,12 +46,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        default='Pipfile.lock')
         return p
 
-    def __init__(self,
+    def __init__(self, *,
                  logger: 'Logger',
                  **kwargs: Any) -> None:
         self._logger = logger
 
-    def __call__(self,  # type:ignore[override]
+    def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
         from cyclonedx.model.bom import Bom
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index b37b8012..e6eddcff 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -46,12 +46,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        default='poetry.lock')
         return p
 
-    def __init__(self,
+    def __init__(self, *,
                  logger: 'Logger',
                  **kwargs: Any) -> None:
         self._logger = logger
 
-    def __call__(self,  # type:ignore[override]
+    def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
         from cyclonedx.model.bom import Bom
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 639ae3fd..fa7ca457 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -59,12 +59,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        default='requirements.txt')
         return p
 
-    def __init__(self,
+    def __init__(self, *,
                  logger: 'Logger',
                  **kwargs: Any) -> None:
         self._logger = logger
 
-    def __call__(self,  # type:ignore[override]
+    def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
         from collections import Counter
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index 951c65c0..d72ae95d 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -33,7 +33,7 @@ def io2str(io: BinaryIO) -> str:
     return data.decode(encoding)
 
 
-def io2textfile(io: BinaryIO) -> '_TemporaryFileWrapper':
+def io2textfile(io: BinaryIO) -> '_TemporaryFileWrapper[str]':
     tf = NamedTemporaryFile('wt', encoding='utf8')
     tf.write(io2str(io))
     tf.flush()
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 44fdd304..17a888ae 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -14,6 +14,8 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
 import re
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob

From ca4880e3f01feb6b1f10cf3eecb0c2ec23eea3f1 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 16:05:00 +0100
Subject: [PATCH 026/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py          | 14 ++---
 cyclonedx_py/_internal/pipenv.py       |  2 -
 cyclonedx_py/_internal/requirements.py |  6 +-
 poetry.lock                            | 76 +++++++++++++-------------
 pyproject.toml                         |  2 +-
 5 files changed, 49 insertions(+), 51 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index f55695c6..993581df 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -15,6 +15,8 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
+
+import logging
 import sys
 from argparse import ArgumentParser, ArgumentTypeError, FileType, RawDescriptionHelpFormatter
 from typing import TYPE_CHECKING, Any, Dict, List, Optional, TextIO, Type
@@ -192,10 +194,7 @@ def __call__(self,
         self.write(output, outfile)
 
 
-def main(*, args: Optional[List[str]] = None, **kwargs: Any) -> int:
-    import logging
-    from sys import stderr
-
+def main(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
     arg_co = ArgumentParser(add_help=False)
     arg_co.add_argument('-v', '--verbose',
                         help='Increase the verbosity of messages (multiple for more effect) (default: silent)',
@@ -204,14 +203,15 @@ def main(*, args: Optional[List[str]] = None, **kwargs: Any) -> int:
                         default=0)
     arg_parser = Command.make_argument_parser(sco=arg_co, **kwargs)
     del arg_co
-    args = vars(arg_parser.parse_args(args))
-
+    args = vars(arg_parser.parse_args(argv))
     if args['command'] is None:
+        # print the help page on error, instead of usage
         arg_parser.print_help()
         return 1
+    del arg_parser, argv
 
     ll = (logging.ERROR, logging.WARNING, logging.INFO, logging.DEBUG)[min(3, args.pop('verbosity'))]
-    lh = logging.StreamHandler(stderr)
+    lh = logging.StreamHandler(sys.stderr)
     lh.setLevel(ll)
     lh.setFormatter(logging.Formatter('%(levelname)-8s | %(name)s > %(message)s'))
     logger = logging.getLogger('CDX')
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index bf66cebb..ec375e97 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -56,7 +56,5 @@ def __call__(self, *,  # type:ignore[override]
                  **kwargs: Any) -> 'Bom':
         from cyclonedx.model.bom import Bom
 
-        if not isinstance(infile, list):
-            infile = [infile]
         # TODO
         return Bom()
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index fa7ca457..88c8af23 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, BinaryIO
+from typing import TYPE_CHECKING, Any, BinaryIO, Dict
 
 from . import BomBuilder
 
@@ -73,12 +73,12 @@ def __call__(self, *,  # type:ignore[override]
         from cyclonedx.model.bom import Bom
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
-        from pip_requirements_parser import RequirementsFile
+        from pip_requirements_parser import RequirementsFile  # type: ignore[import-untyped]
 
         from .utils.io import io2textfile
 
         bom = Bom()
-        bom_refs = Counter()
+        bom_refs: Dict[str, int] = Counter()
 
         # no support for `include_nested` intended, so a temp file instead the original path is fine
         with io2textfile(infile) as ff:
diff --git a/poetry.lock b/poetry.lock
index 1a77884d..44005b6f 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -255,20 +255,20 @@ files = [
 
 [[package]]
 name = "filelock"
-version = "3.12.4"
+version = "3.13.1"
 description = "A platform independent file lock."
 category = "dev"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "filelock-3.12.4-py3-none-any.whl", hash = "sha256:08c21d87ded6e2b9da6728c3dff51baf1dcecf973b768ef35bcbc3447edb9ad4"},
-    {file = "filelock-3.12.4.tar.gz", hash = "sha256:2e6f249f1f3654291606e046b09f1fd5eac39b360664c27f5aad072012f8bcbd"},
+    {file = "filelock-3.13.1-py3-none-any.whl", hash = "sha256:57dbda9b35157b05fb3e58ee91448612eb674172fab98ee235ccb0b5bee19a1c"},
+    {file = "filelock-3.13.1.tar.gz", hash = "sha256:521f5f56c50f8426f5e03ad3b281b490a87ef15bc6c526f168290f0c7148d44e"},
 ]
 
 [package.extras]
-docs = ["furo (>=2023.7.26)", "sphinx (>=7.1.2)", "sphinx-autodoc-typehints (>=1.24)"]
-testing = ["covdefaults (>=2.3)", "coverage (>=7.3)", "diff-cover (>=7.7)", "pytest (>=7.4)", "pytest-cov (>=4.1)", "pytest-mock (>=3.11.1)", "pytest-timeout (>=2.1)"]
-typing = ["typing-extensions (>=4.7.1)"]
+docs = ["furo (>=2023.9.10)", "sphinx (>=7.2.6)", "sphinx-autodoc-typehints (>=1.24)"]
+testing = ["covdefaults (>=2.3)", "coverage (>=7.3.2)", "diff-cover (>=8)", "pytest (>=7.4.3)", "pytest-cov (>=4.1)", "pytest-mock (>=3.12)", "pytest-timeout (>=2.2)"]
+typing = ["typing-extensions (>=4.8)"]
 
 [[package]]
 name = "flake8"
@@ -464,14 +464,14 @@ files = [
 
 [[package]]
 name = "jsonschema"
-version = "4.19.1"
+version = "4.19.2"
 description = "An implementation of JSON Schema validation for Python"
 category = "main"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "jsonschema-4.19.1-py3-none-any.whl", hash = "sha256:cd5f1f9ed9444e554b38ba003af06c0a8c2868131e56bfbef0550fb450c0330e"},
-    {file = "jsonschema-4.19.1.tar.gz", hash = "sha256:ec84cc37cfa703ef7cd4928db24f9cb31428a5d0fa77747b8b51a847458e0bbf"},
+    {file = "jsonschema-4.19.2-py3-none-any.whl", hash = "sha256:eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"},
+    {file = "jsonschema-4.19.2.tar.gz", hash = "sha256:c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"},
 ]
 
 [package.dependencies]
@@ -688,39 +688,39 @@ files = [
 
 [[package]]
 name = "mypy"
-version = "1.5.1"
+version = "1.6.1"
 description = "Optional static typing for Python"
 category = "dev"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "mypy-1.5.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:f33592ddf9655a4894aef22d134de7393e95fcbdc2d15c1ab65828eee5c66c70"},
-    {file = "mypy-1.5.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:258b22210a4a258ccd077426c7a181d789d1121aca6db73a83f79372f5569ae0"},
-    {file = "mypy-1.5.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a9ec1f695f0c25986e6f7f8778e5ce61659063268836a38c951200c57479cc12"},
-    {file = "mypy-1.5.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:abed92d9c8f08643c7d831300b739562b0a6c9fcb028d211134fc9ab20ccad5d"},
-    {file = "mypy-1.5.1-cp310-cp310-win_amd64.whl", hash = "sha256:a156e6390944c265eb56afa67c74c0636f10283429171018446b732f1a05af25"},
-    {file = "mypy-1.5.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6ac9c21bfe7bc9f7f1b6fae441746e6a106e48fc9de530dea29e8cd37a2c0cc4"},
-    {file = "mypy-1.5.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:51cb1323064b1099e177098cb939eab2da42fea5d818d40113957ec954fc85f4"},
-    {file = "mypy-1.5.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:596fae69f2bfcb7305808c75c00f81fe2829b6236eadda536f00610ac5ec2243"},
-    {file = "mypy-1.5.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:32cb59609b0534f0bd67faebb6e022fe534bdb0e2ecab4290d683d248be1b275"},
-    {file = "mypy-1.5.1-cp311-cp311-win_amd64.whl", hash = "sha256:159aa9acb16086b79bbb0016145034a1a05360626046a929f84579ce1666b315"},
-    {file = "mypy-1.5.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:f6b0e77db9ff4fda74de7df13f30016a0a663928d669c9f2c057048ba44f09bb"},
-    {file = "mypy-1.5.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:26f71b535dfc158a71264e6dc805a9f8d2e60b67215ca0bfa26e2e1aa4d4d373"},
-    {file = "mypy-1.5.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2fc3a600f749b1008cc75e02b6fb3d4db8dbcca2d733030fe7a3b3502902f161"},
-    {file = "mypy-1.5.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:26fb32e4d4afa205b24bf645eddfbb36a1e17e995c5c99d6d00edb24b693406a"},
-    {file = "mypy-1.5.1-cp312-cp312-win_amd64.whl", hash = "sha256:82cb6193de9bbb3844bab4c7cf80e6227d5225cc7625b068a06d005d861ad5f1"},
-    {file = "mypy-1.5.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:4a465ea2ca12804d5b34bb056be3a29dc47aea5973b892d0417c6a10a40b2d65"},
-    {file = "mypy-1.5.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:9fece120dbb041771a63eb95e4896791386fe287fefb2837258925b8326d6160"},
-    {file = "mypy-1.5.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d28ddc3e3dfeab553e743e532fb95b4e6afad51d4706dd22f28e1e5e664828d2"},
-    {file = "mypy-1.5.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:57b10c56016adce71fba6bc6e9fd45d8083f74361f629390c556738565af8eeb"},
-    {file = "mypy-1.5.1-cp38-cp38-win_amd64.whl", hash = "sha256:ff0cedc84184115202475bbb46dd99f8dcb87fe24d5d0ddfc0fe6b8575c88d2f"},
-    {file = "mypy-1.5.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:8f772942d372c8cbac575be99f9cc9d9fb3bd95c8bc2de6c01411e2c84ebca8a"},
-    {file = "mypy-1.5.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:5d627124700b92b6bbaa99f27cbe615c8ea7b3402960f6372ea7d65faf376c14"},
-    {file = "mypy-1.5.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:361da43c4f5a96173220eb53340ace68cda81845cd88218f8862dfb0adc8cddb"},
-    {file = "mypy-1.5.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:330857f9507c24de5c5724235e66858f8364a0693894342485e543f5b07c8693"},
-    {file = "mypy-1.5.1-cp39-cp39-win_amd64.whl", hash = "sha256:c543214ffdd422623e9fedd0869166c2f16affe4ba37463975043ef7d2ea8770"},
-    {file = "mypy-1.5.1-py3-none-any.whl", hash = "sha256:f757063a83970d67c444f6e01d9550a7402322af3557ce7630d3c957386fa8f5"},
-    {file = "mypy-1.5.1.tar.gz", hash = "sha256:b031b9601f1060bf1281feab89697324726ba0c0bae9d7cd7ab4b690940f0b92"},
+    {file = "mypy-1.6.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e5012e5cc2ac628177eaac0e83d622b2dd499e28253d4107a08ecc59ede3fc2c"},
+    {file = "mypy-1.6.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:d8fbb68711905f8912e5af474ca8b78d077447d8f3918997fecbf26943ff3cbb"},
+    {file = "mypy-1.6.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:21a1ad938fee7d2d96ca666c77b7c494c3c5bd88dff792220e1afbebb2925b5e"},
+    {file = "mypy-1.6.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:b96ae2c1279d1065413965c607712006205a9ac541895004a1e0d4f281f2ff9f"},
+    {file = "mypy-1.6.1-cp310-cp310-win_amd64.whl", hash = "sha256:40b1844d2e8b232ed92e50a4bd11c48d2daa351f9deee6c194b83bf03e418b0c"},
+    {file = "mypy-1.6.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:81af8adaa5e3099469e7623436881eff6b3b06db5ef75e6f5b6d4871263547e5"},
+    {file = "mypy-1.6.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:8c223fa57cb154c7eab5156856c231c3f5eace1e0bed9b32a24696b7ba3c3245"},
+    {file = "mypy-1.6.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a8032e00ce71c3ceb93eeba63963b864bf635a18f6c0c12da6c13c450eedb183"},
+    {file = "mypy-1.6.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:4c46b51de523817a0045b150ed11b56f9fff55f12b9edd0f3ed35b15a2809de0"},
+    {file = "mypy-1.6.1-cp311-cp311-win_amd64.whl", hash = "sha256:19f905bcfd9e167159b3d63ecd8cb5e696151c3e59a1742e79bc3bcb540c42c7"},
+    {file = "mypy-1.6.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:82e469518d3e9a321912955cc702d418773a2fd1e91c651280a1bda10622f02f"},
+    {file = "mypy-1.6.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d4473c22cc296425bbbce7e9429588e76e05bc7342da359d6520b6427bf76660"},
+    {file = "mypy-1.6.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:59a0d7d24dfb26729e0a068639a6ce3500e31d6655df8557156c51c1cb874ce7"},
+    {file = "mypy-1.6.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:cfd13d47b29ed3bbaafaff7d8b21e90d827631afda134836962011acb5904b71"},
+    {file = "mypy-1.6.1-cp312-cp312-win_amd64.whl", hash = "sha256:eb4f18589d196a4cbe5290b435d135dee96567e07c2b2d43b5c4621b6501531a"},
+    {file = "mypy-1.6.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:41697773aa0bf53ff917aa077e2cde7aa50254f28750f9b88884acea38a16169"},
+    {file = "mypy-1.6.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:7274b0c57737bd3476d2229c6389b2ec9eefeb090bbaf77777e9d6b1b5a9d143"},
+    {file = "mypy-1.6.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bbaf4662e498c8c2e352da5f5bca5ab29d378895fa2d980630656178bd607c46"},
+    {file = "mypy-1.6.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:bb8ccb4724f7d8601938571bf3f24da0da791fe2db7be3d9e79849cb64e0ae85"},
+    {file = "mypy-1.6.1-cp38-cp38-win_amd64.whl", hash = "sha256:68351911e85145f582b5aa6cd9ad666c8958bcae897a1bfda8f4940472463c45"},
+    {file = "mypy-1.6.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:49ae115da099dcc0922a7a895c1eec82c1518109ea5c162ed50e3b3594c71208"},
+    {file = "mypy-1.6.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:8b27958f8c76bed8edaa63da0739d76e4e9ad4ed325c814f9b3851425582a3cd"},
+    {file = "mypy-1.6.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:925cd6a3b7b55dfba252b7c4561892311c5358c6b5a601847015a1ad4eb7d332"},
+    {file = "mypy-1.6.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:8f57e6b6927a49550da3d122f0cb983d400f843a8a82e65b3b380d3d7259468f"},
+    {file = "mypy-1.6.1-cp39-cp39-win_amd64.whl", hash = "sha256:a43ef1c8ddfdb9575691720b6352761f3f53d85f1b57d7745701041053deff30"},
+    {file = "mypy-1.6.1-py3-none-any.whl", hash = "sha256:4cbe68ef919c28ea561165206a2dcb68591c50f3bcf777932323bc208d949cf1"},
+    {file = "mypy-1.6.1.tar.gz", hash = "sha256:4d01c00d09a0be62a4ca3f933e315455bde83f37f892ba4b08ce92f3cf44bcc1"},
 ]
 
 [package.dependencies]
@@ -1426,4 +1426,4 @@ testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "p
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.8"
-content-hash = "f92110595709c3862f7332df548cf325501d2a3feaa6cf2dbe9ae9d0e58077ae"
+content-hash = "ebc6e32194eae0525c1cce83c649fee60b800f6a0be0a52753ec2062202bcb51"
diff --git a/pyproject.toml b/pyproject.toml
index dcf7eb4e..739a4778 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -60,7 +60,7 @@ flake8-bugbear = { version = "23.7.10", python = ">=3.8.1" }
 flake8-isort = "6.0.0"
 isort = "5.12.0"
 autopep8 = "2.0.4"
-mypy = "1.5.1"
+mypy = "1.6.1"
 bandit = "1.7.5"
 tox = "4.11.3"
 # `types-toml` need to stay in sync with version of `toml`

From 6c340acf9b8eec2aa766c535b7e99ee10176c1b4 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 17:33:31 +0100
Subject: [PATCH 027/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py        |  7 +-
 .../_data/infiles/requirements-duplicate.txt  |  4 --
 .../requirements-duplicate.txt-1.0.xml.bin    | 17 -----
 .../requirements-duplicate.txt-1.1.xml.bin    | 15 ----
 .../requirements-duplicate.txt-1.2.json.bin   | 39 ----------
 .../requirements-duplicate.txt-1.2.xml.bin    | 28 --------
 .../requirements-duplicate.txt-1.3.json.bin   | 39 ----------
 .../requirements-duplicate.txt-1.3.xml.bin    | 28 --------
 .../requirements-duplicate.txt-1.4.json.bin   | 72 -------------------
 .../requirements-duplicate.txt-1.4.xml.bin    | 53 --------------
 10 files changed, 1 insertion(+), 301 deletions(-)
 delete mode 100644 tests/_data/infiles/requirements-duplicate.txt
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin
 delete mode 100644 tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 88c8af23..dcc6ffab 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -78,7 +78,6 @@ def __call__(self, *,  # type:ignore[override]
         from .utils.io import io2textfile
 
         bom = Bom()
-        bom_refs: Dict[str, int] = Counter()
 
         # no support for `include_nested` intended, so a temp file instead the original path is fine
         with io2textfile(infile) as ff:
@@ -86,10 +85,6 @@ def __call__(self, *,  # type:ignore[override]
         for requirement in requirements:
             version = requirement.get_pinned_version or None
             download_url = requirement.link and requirement.link.url or None
-            bom_ref = requirement.name or 'unknown'
-            bom_refs[bom_ref] += 1
-            if bom_refs[bom_ref] > 1:
-                bom_ref += f'-{bom_refs[bom_ref]:x}'
             component = Component(
                 type=ComponentType.LIBRARY,
                 name=requirement.name or 'unknown',
@@ -98,7 +93,7 @@ def __call__(self, *,  # type:ignore[override]
                 purl=PackageURL(type='pypi', name=requirement.name, version=version,
                                 qualifiers=download_url and {'download_url': download_url}
                                 ) if requirement.name else None,
-                bom_ref=bom_ref,
+                bom_ref=requirement.name or None,
                 external_references=[
                     ExternalReference(type=ExternalReferenceType.DISTRIBUTION, url=XsUri(download_url))
                 ] if download_url else None
diff --git a/tests/_data/infiles/requirements-duplicate.txt b/tests/_data/infiles/requirements-duplicate.txt
deleted file mode 100644
index 323d366e..00000000
--- a/tests/_data/infiles/requirements-duplicate.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-# duplicate call
-
-colorama>=0.4
-colorama==0.4.6
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin
deleted file mode 100644
index 890ce8ca..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.0.xml.bin
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>colorama</name>
-      <version/>
-      <purl>pkg:pypi/colorama</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin
deleted file mode 100644
index 2fc9b1c2..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.1.xml.bin
+++ /dev/null
@@ -1,15 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="colorama-2">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="colorama">
-      <name>colorama</name>
-      <version/>
-      <purl>pkg:pypi/colorama</purl>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin
deleted file mode 100644
index bdf1e0b2..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.2.json.bin
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "colorama-2",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "colorama",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama",
-      "type": "library",
-      "version": ""
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "colorama"
-    },
-    {
-      "ref": "colorama-2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin
deleted file mode 100644
index 894fcc3a..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.2.xml.bin
+++ /dev/null
@@ -1,28 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="colorama-2">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="colorama">
-      <name>colorama</name>
-      <version/>
-      <purl>pkg:pypi/colorama</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="colorama"/>
-    <dependency ref="colorama-2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin
deleted file mode 100644
index b90c2147..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.3.json.bin
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "colorama-2",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "colorama",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama",
-      "type": "library",
-      "version": ""
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "colorama"
-    },
-    {
-      "ref": "colorama-2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin
deleted file mode 100644
index d82e4472..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.3.xml.bin
+++ /dev/null
@@ -1,28 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="colorama-2">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="colorama">
-      <name>colorama</name>
-      <version/>
-      <purl>pkg:pypi/colorama</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="colorama"/>
-    <dependency ref="colorama-2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin
deleted file mode 100644
index 15d06171..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.4.json.bin
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "colorama-2",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "colorama",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama",
-      "type": "library"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "colorama"
-    },
-    {
-      "ref": "colorama-2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin
deleted file mode 100644
index f7d294c5..00000000
--- a/tests/_data/snapshots/requirements-duplicate.txt-1.4.xml.bin
+++ /dev/null
@@ -1,53 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="colorama-2">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="colorama">
-      <name>colorama</name>
-      <purl>pkg:pypi/colorama</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="colorama"/>
-    <dependency ref="colorama-2"/>
-  </dependencies>
-</bom>

From 06df04b7f94ee0c09712a89c47a9a70a19dcd63f Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 22:08:47 +0100
Subject: [PATCH 028/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 poetry.lock    | 8 ++++----
 pyproject.toml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index 44005b6f..a292453f 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -194,14 +194,14 @@ toml = ["tomli"]
 
 [[package]]
 name = "cyclonedx-python-lib"
-version = "5.0.1"
+version = "5.1.0"
 description = "Python library for CycloneDX"
 category = "main"
 optional = false
 python-versions = ">=3.8,<4.0"
 files = [
-    {file = "cyclonedx_python_lib-5.0.1-py3-none-any.whl", hash = "sha256:88de3c1c59ed849cfe3ffc9405636a26e07c4128c2cfebf02e18bd3efa1668d3"},
-    {file = "cyclonedx_python_lib-5.0.1.tar.gz", hash = "sha256:e2fe858c9411dd0b84a7df9529d740d6b0bc8c96a86434ffe46e2b37d82ccac9"},
+    {file = "cyclonedx_python_lib-5.1.0-py3-none-any.whl", hash = "sha256:4cf64c2e8e3e12051b56560744ad690b15670c46a15835e3d6725b8521c537bf"},
+    {file = "cyclonedx_python_lib-5.1.0.tar.gz", hash = "sha256:c315cd977c4e6052b5145f96c8eea446e49755ed337e67e55462a1a4e1de47a4"},
 ]
 
 [package.dependencies]
@@ -1426,4 +1426,4 @@ testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "p
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.8"
-content-hash = "ebc6e32194eae0525c1cce83c649fee60b800f6a0be0a52753ec2062202bcb51"
+content-hash = "6a869b3dfd89b9a131aec381d9c0b251fd786fe8ea356851df8a43698eee832d"
diff --git a/pyproject.toml b/pyproject.toml
index 739a4778..30c0d60b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -43,7 +43,7 @@ classifiers = [
 [tool.poetry.dependencies]
 python = "^3.8"
 # ATTENTION: keep `deps.lowest.r` file in sync
-cyclonedx-python-lib = { version="^5.0.0", extras=['validation'] }
+cyclonedx-python-lib = { version="^5.1.0", extras=['validation'] }
 packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
 setuptools = ">= 47.0.0"

From 7b6785927f01bed011f9eeffdceaaed07ae449a3 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 23:10:28 +0100
Subject: [PATCH 029/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/pipenv.py              |  6 +-
 cyclonedx_py/_internal/poetry.py              |  6 +-
 cyclonedx_py/_internal/requirements.py        |  8 +--
 cyclonedx_py/_internal/utils/bom.py           | 30 ++++++++++
 .../requirements-frozen.txt-1.2.json.bin      | 10 +---
 .../requirements-frozen.txt-1.2.xml.bin       | 10 +---
 .../requirements-frozen.txt-1.3.json.bin      | 10 +---
 .../requirements-frozen.txt-1.3.xml.bin       | 10 +---
 .../requirements-frozen.txt-1.4.json.bin      | 44 +-------------
 .../requirements-frozen.txt-1.4.xml.bin       | 36 +----------
 .../requirements-local.txt-1.1.xml.bin        |  6 +-
 .../requirements-local.txt-1.2.json.bin       | 26 +++-----
 .../requirements-local.txt-1.2.xml.bin        | 22 +++----
 .../requirements-local.txt-1.3.json.bin       | 26 +++-----
 .../requirements-local.txt-1.3.xml.bin        | 22 +++----
 .../requirements-local.txt-1.4.json.bin       | 60 +++----------------
 .../requirements-local.txt-1.4.xml.bin        | 48 +++------------
 ...irements-private-packages.txt-1.2.json.bin | 10 +---
 ...uirements-private-packages.txt-1.2.xml.bin | 10 +---
 ...irements-private-packages.txt-1.3.json.bin | 10 +---
 ...uirements-private-packages.txt-1.3.xml.bin | 10 +---
 ...irements-private-packages.txt-1.4.json.bin | 44 +-------------
 ...uirements-private-packages.txt-1.4.xml.bin | 36 +----------
 ...ssion-issue448.cp1252.txt.bin-1.2.json.bin | 10 +---
 ...ession-issue448.cp1252.txt.bin-1.2.xml.bin | 10 +---
 ...ssion-issue448.cp1252.txt.bin-1.3.json.bin | 10 +---
 ...ession-issue448.cp1252.txt.bin-1.3.xml.bin | 10 +---
 ...ssion-issue448.cp1252.txt.bin-1.4.json.bin | 44 +-------------
 ...ession-issue448.cp1252.txt.bin-1.4.xml.bin | 36 +----------
 ...equirements-with-comments.txt-1.2.json.bin | 10 +---
 ...requirements-with-comments.txt-1.2.xml.bin | 10 +---
 ...equirements-with-comments.txt-1.3.json.bin | 10 +---
 ...requirements-with-comments.txt-1.3.xml.bin | 10 +---
 ...equirements-with-comments.txt-1.4.json.bin | 44 +-------------
 ...requirements-with-comments.txt-1.4.xml.bin | 36 +----------
 .../requirements-with-hashes.txt-1.2.json.bin | 10 +---
 .../requirements-with-hashes.txt-1.2.xml.bin  | 10 +---
 .../requirements-with-hashes.txt-1.3.json.bin | 10 +---
 .../requirements-with-hashes.txt-1.3.xml.bin  | 10 +---
 .../requirements-with-hashes.txt-1.4.json.bin | 44 +-------------
 .../requirements-with-hashes.txt-1.4.xml.bin  | 36 +----------
 .../requirements-with-urls.txt-1.2.json.bin   | 10 +---
 .../requirements-with-urls.txt-1.2.xml.bin    | 10 +---
 .../requirements-with-urls.txt-1.3.json.bin   | 10 +---
 .../requirements-with-urls.txt-1.3.xml.bin    | 10 +---
 .../requirements-with-urls.txt-1.4.json.bin   | 44 +-------------
 .../requirements-with-urls.txt-1.4.xml.bin    | 36 +----------
 ...s-without-pinned-versions.txt-1.2.json.bin | 10 +---
 ...ts-without-pinned-versions.txt-1.2.xml.bin | 10 +---
 ...s-without-pinned-versions.txt-1.3.json.bin | 10 +---
 ...ts-without-pinned-versions.txt-1.3.xml.bin | 10 +---
 ...s-without-pinned-versions.txt-1.4.json.bin | 44 +-------------
 ...ts-without-pinned-versions.txt-1.4.xml.bin | 36 +----------
 tests/integration/test_requirements.py        | 18 ++++--
 54 files changed, 147 insertions(+), 971 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/bom.py

diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index ec375e97..c13ec05f 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -54,7 +54,9 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
-        from cyclonedx.model.bom import Bom
+        from .utils.bom import make_bom
 
+        bom = make_bom()
         # TODO
-        return Bom()
+
+        return bom
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index e6eddcff..b42790dc 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -54,7 +54,9 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
-        from cyclonedx.model.bom import Bom
+        from .utils.bom import make_bom
 
+        bom = make_bom()
         # TODO
-        return Bom()
+
+        return bom
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index dcc6ffab..0e32be30 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, BinaryIO, Dict
+from typing import TYPE_CHECKING, Any, BinaryIO
 
 from . import BomBuilder
 
@@ -67,17 +67,15 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
-        from collections import Counter
-
         from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
-        from cyclonedx.model.bom import Bom
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
         from pip_requirements_parser import RequirementsFile  # type: ignore[import-untyped]
 
+        from .utils.bom import make_bom
         from .utils.io import io2textfile
 
-        bom = Bom()
+        bom = make_bom()
 
         # no support for `include_nested` intended, so a temp file instead the original path is fine
         with io2textfile(infile) as ff:
diff --git a/cyclonedx_py/_internal/utils/bom.py b/cyclonedx_py/_internal/utils/bom.py
new file mode 100644
index 00000000..d0cf93bb
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/bom.py
@@ -0,0 +1,30 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from cyclonedx.model import Tool
+from cyclonedx.model.bom import Bom
+
+from cyclonedx_py import __name__, __version__
+
+
+def make_bom() -> Bom:
+    bom = Bom()
+    bom.metadata.tools.add(Tool(name=__name__,
+                                vendor='CycloneDX',
+                                version=__version__))
+    return bom
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin b/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin
index 1b19c0a5..5e0b286c 100644
--- a/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin
@@ -33,15 +33,7 @@
       "ref": "colorama"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin
index 528eda45..880077b3 100644
--- a/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="FooProject">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin b/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin
index d6601eac..f8a7359f 100644
--- a/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin
@@ -33,15 +33,7 @@
       "ref": "colorama"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin
index 89d27cc4..6236c55b 100644
--- a/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="FooProject">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin b/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin
index 343a49e4..bf2fac12 100644
--- a/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin
@@ -33,49 +33,7 @@
       "ref": "colorama"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin
index c555cbbc..8a1b8c75 100644
--- a/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="FooProject">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
index ed599657..316c0cb1 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
@@ -21,7 +21,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown">
+    <component type="library" bom-ref="e7a4a3e9-4127-471b-ab91-51d048ab7516">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -30,7 +30,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-2">
+    <component type="library" bom-ref="f24a231f-842e-4fcf-a580-0b8c870aad05">
       <name>unknown</name>
       <version/>
       <hashes>
@@ -42,7 +42,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-3">
+    <component type="library" bom-ref="f07e11a9-901c-4c64-a988-c1a34b3d530d">
       <name>unknown</name>
       <version/>
       <externalReferences>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.json.bin b/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
index d5ca940d..e38f046a 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
@@ -27,7 +27,7 @@
       "version": "1.9.2"
     },
     {
-      "bom-ref": "unknown",
+      "bom-ref": "4ea17845-3a27-4384-afd3-dac51f5e34a6",
       "externalReferences": [
         {
           "type": "distribution",
@@ -39,7 +39,7 @@
       "version": ""
     },
     {
-      "bom-ref": "unknown-2",
+      "bom-ref": "b94348cb-157e-4aa8-8acc-ae4e884c1ee3",
       "externalReferences": [
         {
           "type": "distribution",
@@ -57,7 +57,7 @@
       "version": ""
     },
     {
-      "bom-ref": "unknown-3",
+      "bom-ref": "68c97a06-ff16-48b6-bfd1-85fe465b7a65",
       "externalReferences": [
         {
           "type": "distribution",
@@ -71,30 +71,22 @@
   ],
   "dependencies": [
     {
-      "ref": "foo"
+      "ref": "4ea17845-3a27-4384-afd3-dac51f5e34a6"
     },
     {
-      "ref": "numpy"
+      "ref": "68c97a06-ff16-48b6-bfd1-85fe465b7a65"
     },
     {
-      "ref": "unknown"
+      "ref": "b94348cb-157e-4aa8-8acc-ae4e884c1ee3"
     },
     {
-      "ref": "unknown-2"
+      "ref": "foo"
     },
     {
-      "ref": "unknown-3"
+      "ref": "numpy"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
index 46d1e9c5..341bd91a 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="foo">
       <name>foo</name>
@@ -30,7 +22,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown">
+    <component type="library" bom-ref="4a3ae09d-8bb2-45e6-af57-74b4a1fb9d86">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -39,7 +31,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-2">
+    <component type="library" bom-ref="47553a97-d40e-43c0-b30f-8dbb40a352a1">
       <name>unknown</name>
       <version/>
       <hashes>
@@ -51,7 +43,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-3">
+    <component type="library" bom-ref="d026fdd1-9647-49ef-becf-26e621524c48">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -62,10 +54,10 @@
     </component>
   </components>
   <dependencies>
+    <dependency ref="47553a97-d40e-43c0-b30f-8dbb40a352a1"/>
+    <dependency ref="4a3ae09d-8bb2-45e6-af57-74b4a1fb9d86"/>
+    <dependency ref="d026fdd1-9647-49ef-becf-26e621524c48"/>
     <dependency ref="foo"/>
     <dependency ref="numpy"/>
-    <dependency ref="unknown"/>
-    <dependency ref="unknown-2"/>
-    <dependency ref="unknown-3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.json.bin b/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
index beceb00b..2cb46100 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
@@ -27,7 +27,7 @@
       "version": "1.9.2"
     },
     {
-      "bom-ref": "unknown",
+      "bom-ref": "3078c7db-a145-4f4a-b2fe-6e167d9b9daa",
       "externalReferences": [
         {
           "type": "distribution",
@@ -39,7 +39,7 @@
       "version": ""
     },
     {
-      "bom-ref": "unknown-2",
+      "bom-ref": "4515ae6b-f822-461b-8af0-7158c600f258",
       "externalReferences": [
         {
           "type": "distribution",
@@ -57,7 +57,7 @@
       "version": ""
     },
     {
-      "bom-ref": "unknown-3",
+      "bom-ref": "cb9e5c2a-30de-40a1-bb7e-243da8e28705",
       "externalReferences": [
         {
           "type": "distribution",
@@ -71,30 +71,22 @@
   ],
   "dependencies": [
     {
-      "ref": "foo"
+      "ref": "3078c7db-a145-4f4a-b2fe-6e167d9b9daa"
     },
     {
-      "ref": "numpy"
+      "ref": "4515ae6b-f822-461b-8af0-7158c600f258"
     },
     {
-      "ref": "unknown"
+      "ref": "cb9e5c2a-30de-40a1-bb7e-243da8e28705"
     },
     {
-      "ref": "unknown-2"
+      "ref": "foo"
     },
     {
-      "ref": "unknown-3"
+      "ref": "numpy"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
index e56a7519..ffa49790 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="foo">
       <name>foo</name>
@@ -30,7 +22,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown">
+    <component type="library" bom-ref="d775aa0f-078c-4b6e-9938-b65e549ad7cc">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -39,7 +31,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-2">
+    <component type="library" bom-ref="842f21b1-23ea-4cfa-a37b-05cb8eff4dcc">
       <name>unknown</name>
       <version/>
       <hashes>
@@ -51,7 +43,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-3">
+    <component type="library" bom-ref="b4138bc7-397b-4262-9f40-bb0adbaba540">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -62,10 +54,10 @@
     </component>
   </components>
   <dependencies>
+    <dependency ref="842f21b1-23ea-4cfa-a37b-05cb8eff4dcc"/>
+    <dependency ref="b4138bc7-397b-4262-9f40-bb0adbaba540"/>
+    <dependency ref="d775aa0f-078c-4b6e-9938-b65e549ad7cc"/>
     <dependency ref="foo"/>
     <dependency ref="numpy"/>
-    <dependency ref="unknown"/>
-    <dependency ref="unknown-2"/>
-    <dependency ref="unknown-3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.json.bin b/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
index daac62a7..3018bdd5 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
@@ -26,7 +26,7 @@
       "version": "1.9.2"
     },
     {
-      "bom-ref": "unknown",
+      "bom-ref": "86d0a0cb-56e8-4d56-8d8e-8901ef235970",
       "externalReferences": [
         {
           "type": "distribution",
@@ -37,7 +37,7 @@
       "type": "library"
     },
     {
-      "bom-ref": "unknown-2",
+      "bom-ref": "98332247-5738-40ec-971d-3f98711a55d4",
       "externalReferences": [
         {
           "type": "distribution",
@@ -54,7 +54,7 @@
       "type": "library"
     },
     {
-      "bom-ref": "unknown-3",
+      "bom-ref": "ce27c9dc-6125-4b81-aac0-1bf37740638c",
       "externalReferences": [
         {
           "type": "distribution",
@@ -67,64 +67,22 @@
   ],
   "dependencies": [
     {
-      "ref": "foo"
+      "ref": "86d0a0cb-56e8-4d56-8d8e-8901ef235970"
     },
     {
-      "ref": "numpy"
+      "ref": "98332247-5738-40ec-971d-3f98711a55d4"
     },
     {
-      "ref": "unknown"
+      "ref": "ce27c9dc-6125-4b81-aac0-1bf37740638c"
     },
     {
-      "ref": "unknown-2"
+      "ref": "foo"
     },
     {
-      "ref": "unknown-3"
+      "ref": "numpy"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
index 328cfd24..4027fca0 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="foo">
       <name>foo</name>
@@ -55,7 +21,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown">
+    <component type="library" bom-ref="07b75482-33f1-4fd8-be0a-94c6a9609768">
       <name>unknown</name>
       <externalReferences>
         <reference type="distribution">
@@ -63,7 +29,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-2">
+    <component type="library" bom-ref="8b237f27-c5e8-4322-8357-084637c845e4">
       <name>unknown</name>
       <hashes>
         <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
@@ -74,7 +40,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="unknown-3">
+    <component type="library" bom-ref="70288f16-f9a0-40c5-bc05-0b8dee97b7c2">
       <name>unknown</name>
       <externalReferences>
         <reference type="distribution">
@@ -84,10 +50,10 @@
     </component>
   </components>
   <dependencies>
+    <dependency ref="07b75482-33f1-4fd8-be0a-94c6a9609768"/>
+    <dependency ref="70288f16-f9a0-40c5-bc05-0b8dee97b7c2"/>
+    <dependency ref="8b237f27-c5e8-4322-8357-084637c845e4"/>
     <dependency ref="foo"/>
     <dependency ref="numpy"/>
-    <dependency ref="unknown"/>
-    <dependency ref="unknown-2"/>
-    <dependency ref="unknown-3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin
index 89484ccc..eabd5795 100644
--- a/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin
@@ -13,15 +13,7 @@
       "ref": "mypackage"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin
index 67c178af..489686fe 100644
--- a/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="mypackage">
       <name>mypackage</name>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin
index 15fc3c72..2fd94ab5 100644
--- a/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin
@@ -13,15 +13,7 @@
       "ref": "mypackage"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin
index 42755fe2..9c790643 100644
--- a/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="mypackage">
       <name>mypackage</name>
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin
index 77ba7318..0f67a11a 100644
--- a/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin
@@ -13,49 +13,7 @@
       "ref": "mypackage"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin
index b8d08244..dc651080 100644
--- a/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="mypackage">
       <name>mypackage</name>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin
index 0aa8bd15..3da5b44c 100644
--- a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin
@@ -33,15 +33,7 @@
       "ref": "setuptools"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin
index 023e6627..56b1b929 100644
--- a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="packageurl-python">
       <name>packageurl-python</name>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin
index f5df8e64..fbaa1aed 100644
--- a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin
@@ -33,15 +33,7 @@
       "ref": "setuptools"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin
index 98cc41d8..8ece8595 100644
--- a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="packageurl-python">
       <name>packageurl-python</name>
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin
index 7436db91..03f83ca0 100644
--- a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin
@@ -30,49 +30,7 @@
       "ref": "setuptools"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin
index 0514be57..64d80578 100644
--- a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="packageurl-python">
       <name>packageurl-python</name>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin
index 9287722b..be7e1b98 100644
--- a/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin
@@ -53,15 +53,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin
index 321794a7..9c0754b1 100644
--- a/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin
index e78b8104..fa37b818 100644
--- a/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin
@@ -53,15 +53,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin
index 7b18fac2..cd56db49 100644
--- a/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin
index 9e56efc1..844a1581 100644
--- a/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin
@@ -53,49 +53,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin
index 2fb96e0c..7b6d0fd0 100644
--- a/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin
index 6775d778..987d521f 100644
--- a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin
@@ -63,15 +63,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin
index 998d991c..1f3e01f1 100644
--- a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin
index 28566ef0..c36578c5 100644
--- a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin
@@ -63,15 +63,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin
index 72ae9f25..6dc43b8a 100644
--- a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin
index 2e361d73..d291d844 100644
--- a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin
@@ -63,49 +63,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin
index ac51fb63..297f61b7 100644
--- a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin
index fbc9b5b0..1a3f932d 100644
--- a/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin
@@ -99,15 +99,7 @@
       "ref": "wxPython-Phoenix"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin
index e00d98c2..41cfcc63 100644
--- a/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="package-four">
       <name>package-four</name>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin
index f515c684..39b11b62 100644
--- a/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin
@@ -99,15 +99,7 @@
       "ref": "wxPython-Phoenix"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin
index 4b44b428..9ca5e800 100644
--- a/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="package-four">
       <name>package-four</name>
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin
index 3e87bfd3..d7779da4 100644
--- a/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin
@@ -94,49 +94,7 @@
       "ref": "wxPython-Phoenix"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin
index 89369d76..19f22965 100644
--- a/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="package-four">
       <name>package-four</name>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin
index 4bd61884..60b8e1bf 100644
--- a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin
@@ -33,15 +33,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin
index 7b1b07ba..7c86e50e 100644
--- a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin
index b6c55384..bd6195ee 100644
--- a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin
@@ -33,15 +33,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin
index 498cc0e2..b0dea118 100644
--- a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin
@@ -1,14 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin
index caf7a3c4..fdba7510 100644
--- a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin
@@ -30,49 +30,7 @@
       "ref": "urllib3"
     }
   ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx.github.io/cyclonedx-python-lib/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://cyclonedx.org"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.0.1"
-      }
-    ]
-  },
+  "metadata": {},
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin
index c6b1c537..d215a5cd 100644
--- a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin
@@ -1,40 +1,6 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.0.1</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx.github.io/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://cyclonedx.org</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
+  <metadata/>
   <components>
     <component type="library" bom-ref="certifi">
       <name>certifi</name>
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 17a888ae..979e004b 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -22,7 +22,9 @@
 from io import StringIO
 from os.path import basename, join
 from unittest import TestCase
+from unittest.mock import patch
 
+from cyclonedx.model.bom import Bom
 from cyclonedx.schema import OutputFormat, SchemaVersion
 from ddt import ddt, named_data
 
@@ -36,6 +38,14 @@
 ]
 
 
+def make_bank_bom() -> Bom:
+    bom = Bom()
+    bom.serial_number = None
+    bom.metadata.tools.clear()
+    bom.metadata.timestamp = None
+    return bom
+
+
 @ddt
 class TestRequirements(TestCase, SnapshotMixin):
 
@@ -46,12 +56,13 @@ class TestRequirements(TestCase, SnapshotMixin):
         for of in OutputFormat
         if (of, sv) not in unsupported_of_sf
     ))
+    @patch('cyclonedx_py._internal.utils.bom.make_bom', make_bank_bom)
     def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = 'fakeerr'
             out.name = 'fakeout'
             with redirect_stderr(err), redirect_stdout(out):
-                res = main(args=[
+                res = main(argv=[
                     'requirements',
                     '-vvv',
                     f'--sv={sv.to_version()}',
@@ -62,13 +73,10 @@ def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat)
             out = out.getvalue()
         self.assertEqual(0, res, err)
         self.assertEqualSnapshot(
-            self._make_reproducible(out, of),
+            out,
             f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}')
 
     __REPR_SUB_PATTERN = {
         OutputFormat.JSON: re.compile(r'\s*"(?:timestamp|serialNumber)":\s*".*?",?'),
         OutputFormat.XML: re.compile(r'\s*<timestamp>.*?</timestamp>| serialNumber=".*?"'),
     }
-
-    def _make_reproducible(self, value: str, of: OutputFormat) -> str:
-        return self.__REPR_SUB_PATTERN[of].sub('', value)

From e4b16014c1cb8a1a531f2f0ff83f4cdb13038d42 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 23:20:02 +0100
Subject: [PATCH 030/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py           |  2 +-
 .../snapshots/requirements-local.txt-1.1.xml.bin |  6 +++---
 .../requirements-local.txt-1.2.json.bin          | 16 ++++++++--------
 .../snapshots/requirements-local.txt-1.2.xml.bin | 12 ++++++------
 .../requirements-local.txt-1.3.json.bin          | 16 ++++++++--------
 .../snapshots/requirements-local.txt-1.3.xml.bin | 12 ++++++------
 .../requirements-local.txt-1.4.json.bin          | 16 ++++++++--------
 .../snapshots/requirements-local.txt-1.4.xml.bin | 12 ++++++------
 8 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 0e32be30..8405017f 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -91,7 +91,7 @@ def __call__(self, *,  # type:ignore[override]
                 purl=PackageURL(type='pypi', name=requirement.name, version=version,
                                 qualifiers=download_url and {'download_url': download_url}
                                 ) if requirement.name else None,
-                bom_ref=requirement.name or None,
+                bom_ref=requirement.name or f'requirements#{requirement.line}',
                 external_references=[
                     ExternalReference(type=ExternalReferenceType.DISTRIBUTION, url=XsUri(download_url))
                 ] if download_url else None
diff --git a/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
index 316c0cb1..d1327cc9 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
@@ -21,7 +21,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="e7a4a3e9-4127-471b-ab91-51d048ab7516">
+    <component type="library" bom-ref="requirements#./myproject/chardet">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -30,7 +30,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="f24a231f-842e-4fcf-a580-0b8c870aad05">
+    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
       <name>unknown</name>
       <version/>
       <hashes>
@@ -42,7 +42,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="f07e11a9-901c-4c64-a988-c1a34b3d530d">
+    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
       <name>unknown</name>
       <version/>
       <externalReferences>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.json.bin b/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
index e38f046a..b3d412a6 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.2.json.bin
@@ -27,7 +27,7 @@
       "version": "1.9.2"
     },
     {
-      "bom-ref": "4ea17845-3a27-4384-afd3-dac51f5e34a6",
+      "bom-ref": "requirements#./myproject/chardet",
       "externalReferences": [
         {
           "type": "distribution",
@@ -39,7 +39,7 @@
       "version": ""
     },
     {
-      "bom-ref": "b94348cb-157e-4aa8-8acc-ae4e884c1ee3",
+      "bom-ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
           "type": "distribution",
@@ -57,7 +57,7 @@
       "version": ""
     },
     {
-      "bom-ref": "68c97a06-ff16-48b6-bfd1-85fe465b7a65",
+      "bom-ref": "requirements#-e ./myproject/idna.whl",
       "externalReferences": [
         {
           "type": "distribution",
@@ -71,19 +71,19 @@
   ],
   "dependencies": [
     {
-      "ref": "4ea17845-3a27-4384-afd3-dac51f5e34a6"
+      "ref": "foo"
     },
     {
-      "ref": "68c97a06-ff16-48b6-bfd1-85fe465b7a65"
+      "ref": "numpy"
     },
     {
-      "ref": "b94348cb-157e-4aa8-8acc-ae4e884c1ee3"
+      "ref": "requirements#-e ./myproject/idna.whl"
     },
     {
-      "ref": "foo"
+      "ref": "requirements#./myproject/chardet"
     },
     {
-      "ref": "numpy"
+      "ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
index 341bd91a..a8a4b13d 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
@@ -22,7 +22,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="4a3ae09d-8bb2-45e6-af57-74b4a1fb9d86">
+    <component type="library" bom-ref="requirements#./myproject/chardet">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -31,7 +31,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="47553a97-d40e-43c0-b30f-8dbb40a352a1">
+    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
       <name>unknown</name>
       <version/>
       <hashes>
@@ -43,7 +43,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="d026fdd1-9647-49ef-becf-26e621524c48">
+    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -54,10 +54,10 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="47553a97-d40e-43c0-b30f-8dbb40a352a1"/>
-    <dependency ref="4a3ae09d-8bb2-45e6-af57-74b4a1fb9d86"/>
-    <dependency ref="d026fdd1-9647-49ef-becf-26e621524c48"/>
     <dependency ref="foo"/>
     <dependency ref="numpy"/>
+    <dependency ref="requirements#-e ./myproject/idna.whl"/>
+    <dependency ref="requirements#./myproject/chardet"/>
+    <dependency ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.json.bin b/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
index 2cb46100..5ef00dcf 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.3.json.bin
@@ -27,7 +27,7 @@
       "version": "1.9.2"
     },
     {
-      "bom-ref": "3078c7db-a145-4f4a-b2fe-6e167d9b9daa",
+      "bom-ref": "requirements#./myproject/chardet",
       "externalReferences": [
         {
           "type": "distribution",
@@ -39,7 +39,7 @@
       "version": ""
     },
     {
-      "bom-ref": "4515ae6b-f822-461b-8af0-7158c600f258",
+      "bom-ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
           "type": "distribution",
@@ -57,7 +57,7 @@
       "version": ""
     },
     {
-      "bom-ref": "cb9e5c2a-30de-40a1-bb7e-243da8e28705",
+      "bom-ref": "requirements#-e ./myproject/idna.whl",
       "externalReferences": [
         {
           "type": "distribution",
@@ -71,19 +71,19 @@
   ],
   "dependencies": [
     {
-      "ref": "3078c7db-a145-4f4a-b2fe-6e167d9b9daa"
+      "ref": "foo"
     },
     {
-      "ref": "4515ae6b-f822-461b-8af0-7158c600f258"
+      "ref": "numpy"
     },
     {
-      "ref": "cb9e5c2a-30de-40a1-bb7e-243da8e28705"
+      "ref": "requirements#-e ./myproject/idna.whl"
     },
     {
-      "ref": "foo"
+      "ref": "requirements#./myproject/chardet"
     },
     {
-      "ref": "numpy"
+      "ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
index ffa49790..5ff79399 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
@@ -22,7 +22,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="d775aa0f-078c-4b6e-9938-b65e549ad7cc">
+    <component type="library" bom-ref="requirements#./myproject/chardet">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -31,7 +31,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="842f21b1-23ea-4cfa-a37b-05cb8eff4dcc">
+    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
       <name>unknown</name>
       <version/>
       <hashes>
@@ -43,7 +43,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="b4138bc7-397b-4262-9f40-bb0adbaba540">
+    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
       <name>unknown</name>
       <version/>
       <externalReferences>
@@ -54,10 +54,10 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="842f21b1-23ea-4cfa-a37b-05cb8eff4dcc"/>
-    <dependency ref="b4138bc7-397b-4262-9f40-bb0adbaba540"/>
-    <dependency ref="d775aa0f-078c-4b6e-9938-b65e549ad7cc"/>
     <dependency ref="foo"/>
     <dependency ref="numpy"/>
+    <dependency ref="requirements#-e ./myproject/idna.whl"/>
+    <dependency ref="requirements#./myproject/chardet"/>
+    <dependency ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.json.bin b/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
index 3018bdd5..1007372c 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.4.json.bin
@@ -26,7 +26,7 @@
       "version": "1.9.2"
     },
     {
-      "bom-ref": "86d0a0cb-56e8-4d56-8d8e-8901ef235970",
+      "bom-ref": "requirements#./myproject/chardet",
       "externalReferences": [
         {
           "type": "distribution",
@@ -37,7 +37,7 @@
       "type": "library"
     },
     {
-      "bom-ref": "98332247-5738-40ec-971d-3f98711a55d4",
+      "bom-ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
           "type": "distribution",
@@ -54,7 +54,7 @@
       "type": "library"
     },
     {
-      "bom-ref": "ce27c9dc-6125-4b81-aac0-1bf37740638c",
+      "bom-ref": "requirements#-e ./myproject/idna.whl",
       "externalReferences": [
         {
           "type": "distribution",
@@ -67,19 +67,19 @@
   ],
   "dependencies": [
     {
-      "ref": "86d0a0cb-56e8-4d56-8d8e-8901ef235970"
+      "ref": "foo"
     },
     {
-      "ref": "98332247-5738-40ec-971d-3f98711a55d4"
+      "ref": "numpy"
     },
     {
-      "ref": "ce27c9dc-6125-4b81-aac0-1bf37740638c"
+      "ref": "requirements#-e ./myproject/idna.whl"
     },
     {
-      "ref": "foo"
+      "ref": "requirements#./myproject/chardet"
     },
     {
-      "ref": "numpy"
+      "ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin b/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
index 4027fca0..968e8fb2 100644
--- a/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
@@ -21,7 +21,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="07b75482-33f1-4fd8-be0a-94c6a9609768">
+    <component type="library" bom-ref="requirements#./myproject/chardet">
       <name>unknown</name>
       <externalReferences>
         <reference type="distribution">
@@ -29,7 +29,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="8b237f27-c5e8-4322-8357-084637c845e4">
+    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
       <name>unknown</name>
       <hashes>
         <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
@@ -40,7 +40,7 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="70288f16-f9a0-40c5-bc05-0b8dee97b7c2">
+    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
       <name>unknown</name>
       <externalReferences>
         <reference type="distribution">
@@ -50,10 +50,10 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="07b75482-33f1-4fd8-be0a-94c6a9609768"/>
-    <dependency ref="70288f16-f9a0-40c5-bc05-0b8dee97b7c2"/>
-    <dependency ref="8b237f27-c5e8-4322-8357-084637c845e4"/>
     <dependency ref="foo"/>
     <dependency ref="numpy"/>
+    <dependency ref="requirements#-e ./myproject/idna.whl"/>
+    <dependency ref="requirements#./myproject/chardet"/>
+    <dependency ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"/>
   </dependencies>
 </bom>

From 7c1e131ca9d141cc5f9f5bdd1f7a9cde1601fa72 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 31 Oct 2023 23:40:35 +0100
Subject: [PATCH 031/155] winfixes

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/utils/io.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index d72ae95d..2be25c8d 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -34,7 +34,9 @@ def io2str(io: BinaryIO) -> str:
 
 
 def io2textfile(io: BinaryIO) -> '_TemporaryFileWrapper[str]':
-    tf = NamedTemporaryFile('wt', encoding='utf8')
+    # prevent
+    tf = NamedTemporaryFile('w+t', encoding='utf8')
     tf.write(io2str(io))
     tf.flush()
+    tf.seek(0, 0)
     return tf

From 2c055e7f2eef221219840a60c81f28595eadce22 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 00:04:22 +0100
Subject: [PATCH 032/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/utils/bom.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/utils/bom.py b/cyclonedx_py/_internal/utils/bom.py
index d0cf93bb..33e6945f 100644
--- a/cyclonedx_py/_internal/utils/bom.py
+++ b/cyclonedx_py/_internal/utils/bom.py
@@ -19,12 +19,12 @@
 from cyclonedx.model import Tool
 from cyclonedx.model.bom import Bom
 
-from cyclonedx_py import __name__, __version__
+from cyclonedx_py import __version__
 
 
 def make_bom() -> Bom:
     bom = Bom()
-    bom.metadata.tools.add(Tool(name=__name__,
+    bom.metadata.tools.add(Tool(name='cyclonedx-bom',
                                 vendor='CycloneDX',
                                 version=__version__))
     return bom

From e2efb7ade836c94f7d7d8d5f76ee90535bd6ed20 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 00:34:58 +0100
Subject: [PATCH 033/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 12 ++++++++----
 cyclonedx_py/_internal/utils/io.py     | 11 +++++------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 8405017f..80853d9f 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -14,8 +14,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
+import os
 from typing import TYPE_CHECKING, Any, BinaryIO
 
 from . import BomBuilder
@@ -67,6 +66,8 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
+        from os import unlink
+
         from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
@@ -78,8 +79,11 @@ def __call__(self, *,  # type:ignore[override]
         bom = make_bom()
 
         # no support for `include_nested` intended, so a temp file instead the original path is fine
-        with io2textfile(infile) as ff:
-            requirements = RequirementsFile.from_file(ff.name, include_nested=False).requirements
+        ff = io2textfile(infile)
+        try:
+            requirements = RequirementsFile.from_file(ff, include_nested=False).requirements
+        finally:
+            unlink(ff)
         for requirement in requirements:
             version = requirement.get_pinned_version or None
             download_url = requirement.link and requirement.link.url or None
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index 2be25c8d..e8d2294d 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -33,10 +33,9 @@ def io2str(io: BinaryIO) -> str:
     return data.decode(encoding)
 
 
-def io2textfile(io: BinaryIO) -> '_TemporaryFileWrapper[str]':
-    # prevent
-    tf = NamedTemporaryFile('w+t', encoding='utf8')
+def io2textfile(io: BinaryIO) -> str:
+    # prevent issues on windows: https://github.com/python/cpython/issues/58451
+    tf = NamedTemporaryFile('wt', encoding='utf8', delete=False)
     tf.write(io2str(io))
-    tf.flush()
-    tf.seek(0, 0)
-    return tf
+    tf.close()
+    return tf.name

From cb6d93fda96a1bc1218a2ebc6ba19cf10aac600c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 11:03:07 +0100
Subject: [PATCH 034/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../frozen.txt}                                     |  0
 .../local.txt}                                      |  0
 .../private-packages.txt}                           |  0
 .../regression-issue448.cp1252.txt.bin}             |  0
 .../with-comments.txt}                              |  0
 .../with-hashes.txt}                                |  0
 .../with-urls.txt}                                  |  0
 .../without-pinned-versions.txt}                    |  0
 tests/_data/snapshots/.gitattributes                |  5 +++--
 .../frozen.txt-1.0.xml.bin}                         |  0
 .../frozen.txt-1.1.xml.bin}                         |  0
 .../frozen.txt-1.2.json.bin}                        |  0
 .../frozen.txt-1.2.xml.bin}                         |  0
 .../frozen.txt-1.3.json.bin}                        |  0
 .../frozen.txt-1.3.xml.bin}                         |  0
 .../frozen.txt-1.4.json.bin}                        |  0
 .../frozen.txt-1.4.xml.bin}                         |  0
 .../local.txt-1.0.xml.bin}                          |  0
 .../local.txt-1.1.xml.bin}                          |  0
 .../local.txt-1.2.json.bin}                         |  0
 .../local.txt-1.2.xml.bin}                          |  0
 .../local.txt-1.3.json.bin}                         |  0
 .../local.txt-1.3.xml.bin}                          |  0
 .../local.txt-1.4.json.bin}                         |  0
 .../local.txt-1.4.xml.bin}                          |  0
 .../private-packages.txt-1.0.xml.bin}               |  0
 .../private-packages.txt-1.1.xml.bin}               |  0
 .../private-packages.txt-1.2.json.bin}              |  0
 .../private-packages.txt-1.2.xml.bin}               |  0
 .../private-packages.txt-1.3.json.bin}              |  0
 .../private-packages.txt-1.3.xml.bin}               |  0
 .../private-packages.txt-1.4.json.bin}              |  0
 .../private-packages.txt-1.4.xml.bin}               |  0
 .../regression-issue448.cp1252.txt.bin-1.0.xml.bin} |  0
 .../regression-issue448.cp1252.txt.bin-1.1.xml.bin} |  0
 ...regression-issue448.cp1252.txt.bin-1.2.json.bin} |  0
 .../regression-issue448.cp1252.txt.bin-1.2.xml.bin} |  0
 ...regression-issue448.cp1252.txt.bin-1.3.json.bin} |  0
 .../regression-issue448.cp1252.txt.bin-1.3.xml.bin} |  0
 ...regression-issue448.cp1252.txt.bin-1.4.json.bin} |  0
 .../regression-issue448.cp1252.txt.bin-1.4.xml.bin} |  0
 .../with-comments.txt-1.0.xml.bin}                  |  0
 .../with-comments.txt-1.1.xml.bin}                  |  0
 .../with-comments.txt-1.2.json.bin}                 |  0
 .../with-comments.txt-1.2.xml.bin}                  |  0
 .../with-comments.txt-1.3.json.bin}                 |  0
 .../with-comments.txt-1.3.xml.bin}                  |  0
 .../with-comments.txt-1.4.json.bin}                 |  0
 .../with-comments.txt-1.4.xml.bin}                  |  0
 .../with-hashes.txt-1.0.xml.bin}                    |  0
 .../with-hashes.txt-1.1.xml.bin}                    |  0
 .../with-hashes.txt-1.2.json.bin}                   |  0
 .../with-hashes.txt-1.2.xml.bin}                    |  0
 .../with-hashes.txt-1.3.json.bin}                   |  0
 .../with-hashes.txt-1.3.xml.bin}                    |  0
 .../with-hashes.txt-1.4.json.bin}                   |  0
 .../with-hashes.txt-1.4.xml.bin}                    |  0
 .../with-urls.txt-1.0.xml.bin}                      |  0
 .../with-urls.txt-1.1.xml.bin}                      |  0
 .../with-urls.txt-1.2.json.bin}                     |  0
 .../with-urls.txt-1.2.xml.bin}                      |  0
 .../with-urls.txt-1.3.json.bin}                     |  0
 .../with-urls.txt-1.3.xml.bin}                      |  0
 .../with-urls.txt-1.4.json.bin}                     |  0
 .../with-urls.txt-1.4.xml.bin}                      |  0
 .../without-pinned-versions.txt-1.0.xml.bin}        |  0
 .../without-pinned-versions.txt-1.1.xml.bin}        |  0
 .../without-pinned-versions.txt-1.2.json.bin}       |  0
 .../without-pinned-versions.txt-1.2.xml.bin}        |  0
 .../without-pinned-versions.txt-1.3.json.bin}       |  0
 .../without-pinned-versions.txt-1.3.xml.bin}        |  0
 .../without-pinned-versions.txt-1.4.json.bin}       |  0
 .../without-pinned-versions.txt-1.4.xml.bin}        |  0
 tests/integration/test_requirements.py              | 13 ++++++-------
 74 files changed, 9 insertions(+), 9 deletions(-)
 rename tests/_data/infiles/{requirements-frozen.txt => requirements/frozen.txt} (100%)
 rename tests/_data/infiles/{requirements-local.txt => requirements/local.txt} (100%)
 rename tests/_data/infiles/{requirements-private-packages.txt => requirements/private-packages.txt} (100%)
 rename tests/_data/infiles/{requirements-regression-issue448.cp1252.txt.bin => requirements/regression-issue448.cp1252.txt.bin} (100%)
 rename tests/_data/infiles/{requirements-with-comments.txt => requirements/with-comments.txt} (100%)
 rename tests/_data/infiles/{requirements-with-hashes.txt => requirements/with-hashes.txt} (100%)
 rename tests/_data/infiles/{requirements-with-urls.txt => requirements/with-urls.txt} (100%)
 rename tests/_data/infiles/{requirements-without-pinned-versions.txt => requirements/without-pinned-versions.txt} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.0.xml.bin => requirements/frozen.txt-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.1.xml.bin => requirements/frozen.txt-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.2.json.bin => requirements/frozen.txt-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.2.xml.bin => requirements/frozen.txt-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.3.json.bin => requirements/frozen.txt-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.3.xml.bin => requirements/frozen.txt-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.4.json.bin => requirements/frozen.txt-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-frozen.txt-1.4.xml.bin => requirements/frozen.txt-1.4.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.0.xml.bin => requirements/local.txt-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.1.xml.bin => requirements/local.txt-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.2.json.bin => requirements/local.txt-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.2.xml.bin => requirements/local.txt-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.3.json.bin => requirements/local.txt-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.3.xml.bin => requirements/local.txt-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.4.json.bin => requirements/local.txt-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-local.txt-1.4.xml.bin => requirements/local.txt-1.4.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.0.xml.bin => requirements/private-packages.txt-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.1.xml.bin => requirements/private-packages.txt-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.2.json.bin => requirements/private-packages.txt-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.2.xml.bin => requirements/private-packages.txt-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.3.json.bin => requirements/private-packages.txt-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.3.xml.bin => requirements/private-packages.txt-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.4.json.bin => requirements/private-packages.txt-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-private-packages.txt-1.4.xml.bin => requirements/private-packages.txt-1.4.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.0.xml.bin => requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.1.xml.bin => requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin => requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin => requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin => requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin => requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin => requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin => requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.0.xml.bin => requirements/with-comments.txt-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.1.xml.bin => requirements/with-comments.txt-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.2.json.bin => requirements/with-comments.txt-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.2.xml.bin => requirements/with-comments.txt-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.3.json.bin => requirements/with-comments.txt-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.3.xml.bin => requirements/with-comments.txt-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.4.json.bin => requirements/with-comments.txt-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-comments.txt-1.4.xml.bin => requirements/with-comments.txt-1.4.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.0.xml.bin => requirements/with-hashes.txt-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.1.xml.bin => requirements/with-hashes.txt-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.2.json.bin => requirements/with-hashes.txt-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.2.xml.bin => requirements/with-hashes.txt-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.3.json.bin => requirements/with-hashes.txt-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.3.xml.bin => requirements/with-hashes.txt-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.4.json.bin => requirements/with-hashes.txt-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-hashes.txt-1.4.xml.bin => requirements/with-hashes.txt-1.4.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.0.xml.bin => requirements/with-urls.txt-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.1.xml.bin => requirements/with-urls.txt-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.2.json.bin => requirements/with-urls.txt-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.2.xml.bin => requirements/with-urls.txt-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.3.json.bin => requirements/with-urls.txt-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.3.xml.bin => requirements/with-urls.txt-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.4.json.bin => requirements/with-urls.txt-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-with-urls.txt-1.4.xml.bin => requirements/with-urls.txt-1.4.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.0.xml.bin => requirements/without-pinned-versions.txt-1.0.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.1.xml.bin => requirements/without-pinned-versions.txt-1.1.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.2.json.bin => requirements/without-pinned-versions.txt-1.2.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.2.xml.bin => requirements/without-pinned-versions.txt-1.2.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.3.json.bin => requirements/without-pinned-versions.txt-1.3.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.3.xml.bin => requirements/without-pinned-versions.txt-1.3.xml.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.4.json.bin => requirements/without-pinned-versions.txt-1.4.json.bin} (100%)
 rename tests/_data/snapshots/{requirements-without-pinned-versions.txt-1.4.xml.bin => requirements/without-pinned-versions.txt-1.4.xml.bin} (100%)

diff --git a/tests/_data/infiles/requirements-frozen.txt b/tests/_data/infiles/requirements/frozen.txt
similarity index 100%
rename from tests/_data/infiles/requirements-frozen.txt
rename to tests/_data/infiles/requirements/frozen.txt
diff --git a/tests/_data/infiles/requirements-local.txt b/tests/_data/infiles/requirements/local.txt
similarity index 100%
rename from tests/_data/infiles/requirements-local.txt
rename to tests/_data/infiles/requirements/local.txt
diff --git a/tests/_data/infiles/requirements-private-packages.txt b/tests/_data/infiles/requirements/private-packages.txt
similarity index 100%
rename from tests/_data/infiles/requirements-private-packages.txt
rename to tests/_data/infiles/requirements/private-packages.txt
diff --git a/tests/_data/infiles/requirements-regression-issue448.cp1252.txt.bin b/tests/_data/infiles/requirements/regression-issue448.cp1252.txt.bin
similarity index 100%
rename from tests/_data/infiles/requirements-regression-issue448.cp1252.txt.bin
rename to tests/_data/infiles/requirements/regression-issue448.cp1252.txt.bin
diff --git a/tests/_data/infiles/requirements-with-comments.txt b/tests/_data/infiles/requirements/with-comments.txt
similarity index 100%
rename from tests/_data/infiles/requirements-with-comments.txt
rename to tests/_data/infiles/requirements/with-comments.txt
diff --git a/tests/_data/infiles/requirements-with-hashes.txt b/tests/_data/infiles/requirements/with-hashes.txt
similarity index 100%
rename from tests/_data/infiles/requirements-with-hashes.txt
rename to tests/_data/infiles/requirements/with-hashes.txt
diff --git a/tests/_data/infiles/requirements-with-urls.txt b/tests/_data/infiles/requirements/with-urls.txt
similarity index 100%
rename from tests/_data/infiles/requirements-with-urls.txt
rename to tests/_data/infiles/requirements/with-urls.txt
diff --git a/tests/_data/infiles/requirements-without-pinned-versions.txt b/tests/_data/infiles/requirements/without-pinned-versions.txt
similarity index 100%
rename from tests/_data/infiles/requirements-without-pinned-versions.txt
rename to tests/_data/infiles/requirements/without-pinned-versions.txt
diff --git a/tests/_data/snapshots/.gitattributes b/tests/_data/snapshots/.gitattributes
index cb164e3d..b93c5366 100644
--- a/tests/_data/snapshots/.gitattributes
+++ b/tests/_data/snapshots/.gitattributes
@@ -1,3 +1,4 @@
 # files are compared bype-wise, so they need to be treated as binary
-xml/**      linguist-generated binary diff=xml
-json/**     linguist-generated binary diff=json
+*.bin       linguist-generated binary
+*.xml.bin   linguist-generated binary diff=xml
+*.json.bin  linguist-generated binary diff=json
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-frozen.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.json.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/local.txt-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.json.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/local.txt-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.json.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/local.txt-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-local.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-local.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-private-packages.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.0.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.0.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.1.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.1.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.json.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.2.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.json.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.3.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.json.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-regression-issue448.cp1252.txt.bin-1.4.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-comments.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-hashes.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-with-urls.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
diff --git a/tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements-without-pinned-versions.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 979e004b..df58003e 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -21,6 +21,7 @@
 from glob import glob
 from io import StringIO
 from os.path import basename, join
+from typing import Union
 from unittest import TestCase
 from unittest.mock import patch
 
@@ -31,7 +32,7 @@
 from cyclonedx_py._internal.cli import main
 from tests import INFILES_DIRECTORY, SnapshotMixin
 
-files = glob(join(INFILES_DIRECTORY, 'requirements-*'))
+infiles = glob(join(INFILES_DIRECTORY, 'requirements', '*'))
 unsupported_of_sf = [
     (OutputFormat.JSON, SchemaVersion.V1_1),
     (OutputFormat.JSON, SchemaVersion.V1_0),
@@ -50,8 +51,8 @@ def make_bank_bom() -> Bom:
 class TestRequirements(TestCase, SnapshotMixin):
 
     @named_data(*(
-        [f'{basename(file)}-{sv.name}-{of.name}', file, sv, of]
-        for file in files
+        [f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of]
+        for infile in infiles
         for sv in SchemaVersion
         for of in OutputFormat
         if (of, sv) not in unsupported_of_sf
@@ -76,7 +77,5 @@ def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat)
             out,
             f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}')
 
-    __REPR_SUB_PATTERN = {
-        OutputFormat.JSON: re.compile(r'\s*"(?:timestamp|serialNumber)":\s*".*?",?'),
-        OutputFormat.XML: re.compile(r'\s*<timestamp>.*?</timestamp>| serialNumber=".*?"'),
-    }
+    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
+        super().assertEqualSnapshot(actual, join('requirements', snapshot_name))

From f596b9841d64fc8b726ffdfc4d07d08120cd7d2a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 14:25:16 +0100
Subject: [PATCH 035/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py        | 71 ++++++++++++++-----
 cyclonedx_py/_internal/utils/io.py            |  3 -
 tests/__init__.py                             |  2 +-
 tests/_data/infiles/requirements/local.txt    |  4 +-
 .../infiles/requirements/with-hashes.txt      | 12 ++--
 .../_data/infiles/requirements/with-urls.txt  |  8 ++-
 .../requirements/frozen.txt-1.0.xml.bin       |  2 +
 .../requirements/frozen.txt-1.1.xml.bin       |  6 +-
 .../requirements/frozen.txt-1.2.json.bin      | 10 +--
 .../requirements/frozen.txt-1.2.xml.bin       | 10 +--
 .../requirements/frozen.txt-1.3.json.bin      | 10 +--
 .../requirements/frozen.txt-1.3.xml.bin       | 10 +--
 .../requirements/frozen.txt-1.4.json.bin      | 10 +--
 .../requirements/frozen.txt-1.4.xml.bin       | 10 +--
 .../requirements/local.txt-1.0.xml.bin        | 13 +++-
 .../requirements/local.txt-1.1.xml.bin        | 45 ++++++------
 .../requirements/local.txt-1.2.json.bin       | 68 +++++++++---------
 .../requirements/local.txt-1.2.xml.bin        | 56 ++++++++-------
 .../requirements/local.txt-1.3.json.bin       | 68 +++++++++---------
 .../requirements/local.txt-1.3.xml.bin        | 56 ++++++++-------
 .../requirements/local.txt-1.4.json.bin       | 67 ++++++++---------
 .../requirements/local.txt-1.4.xml.bin        | 55 +++++++-------
 .../private-packages.txt-1.0.xml.bin          |  1 +
 .../private-packages.txt-1.1.xml.bin          |  3 +-
 .../private-packages.txt-1.2.json.bin         |  5 +-
 .../private-packages.txt-1.2.xml.bin          |  5 +-
 .../private-packages.txt-1.3.json.bin         |  5 +-
 .../private-packages.txt-1.3.xml.bin          |  5 +-
 .../private-packages.txt-1.4.json.bin         |  5 +-
 .../private-packages.txt-1.4.xml.bin          |  5 +-
 ...ession-issue448.cp1252.txt.bin-1.0.xml.bin |  3 +
 ...ession-issue448.cp1252.txt.bin-1.1.xml.bin |  9 ++-
 ...ssion-issue448.cp1252.txt.bin-1.2.json.bin | 15 ++--
 ...ession-issue448.cp1252.txt.bin-1.2.xml.bin | 15 ++--
 ...ssion-issue448.cp1252.txt.bin-1.3.json.bin | 15 ++--
 ...ession-issue448.cp1252.txt.bin-1.3.xml.bin | 15 ++--
 ...ssion-issue448.cp1252.txt.bin-1.4.json.bin | 15 ++--
 ...ession-issue448.cp1252.txt.bin-1.4.xml.bin | 15 ++--
 .../with-comments.txt-1.0.xml.bin             |  5 ++
 .../with-comments.txt-1.1.xml.bin             | 15 ++--
 .../with-comments.txt-1.2.json.bin            | 25 ++++---
 .../with-comments.txt-1.2.xml.bin             | 25 ++++---
 .../with-comments.txt-1.3.json.bin            | 25 ++++---
 .../with-comments.txt-1.3.xml.bin             | 25 ++++---
 .../with-comments.txt-1.4.json.bin            | 25 ++++---
 .../with-comments.txt-1.4.xml.bin             | 25 ++++---
 .../requirements/with-hashes.txt-1.0.xml.bin  | 23 +++---
 .../requirements/with-hashes.txt-1.1.xml.bin  | 25 ++++---
 .../requirements/with-hashes.txt-1.2.json.bin | 35 ++++-----
 .../requirements/with-hashes.txt-1.2.xml.bin  | 31 ++++----
 .../requirements/with-hashes.txt-1.3.json.bin | 35 ++++-----
 .../requirements/with-hashes.txt-1.3.xml.bin  | 31 ++++----
 .../requirements/with-hashes.txt-1.4.json.bin | 35 ++++-----
 .../requirements/with-hashes.txt-1.4.xml.bin  | 31 ++++----
 .../requirements/with-urls.txt-1.0.xml.bin    | 20 ++++--
 .../requirements/with-urls.txt-1.1.xml.bin    | 44 ++++++++----
 .../requirements/with-urls.txt-1.2.json.bin   | 62 ++++++++++------
 .../requirements/with-urls.txt-1.2.xml.bin    | 57 +++++++++------
 .../requirements/with-urls.txt-1.3.json.bin   | 62 ++++++++++------
 .../requirements/with-urls.txt-1.3.xml.bin    | 57 +++++++++------
 .../requirements/with-urls.txt-1.4.json.bin   | 61 ++++++++++------
 .../requirements/with-urls.txt-1.4.xml.bin    | 56 +++++++++------
 .../without-pinned-versions.txt-1.0.xml.bin   |  3 +
 .../without-pinned-versions.txt-1.1.xml.bin   |  9 ++-
 .../without-pinned-versions.txt-1.2.json.bin  | 15 ++--
 .../without-pinned-versions.txt-1.2.xml.bin   | 15 ++--
 .../without-pinned-versions.txt-1.3.json.bin  | 15 ++--
 .../without-pinned-versions.txt-1.3.xml.bin   | 15 ++--
 .../without-pinned-versions.txt-1.4.json.bin  | 15 ++--
 .../without-pinned-versions.txt-1.4.xml.bin   | 15 ++--
 tests/integration/test_requirements.py        |  2 -
 71 files changed, 1006 insertions(+), 665 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 80853d9f..97660d93 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -14,8 +14,10 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
-import os
-from typing import TYPE_CHECKING, Any, BinaryIO
+
+
+from os import unlink
+from typing import TYPE_CHECKING, Any, BinaryIO, Iterable
 
 from . import BomBuilder
 
@@ -24,6 +26,7 @@
     from logging import Logger
 
     from cyclonedx.model.bom import Bom
+    from pip_requirements_parser import InstallRequirement
 
 
 # !!! be as lazy loading as possible, as greedy as needed
@@ -66,39 +69,69 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
-        from os import unlink
+        from pip_requirements_parser import RequirementsFile  # type: ignore[import-untyped]
+
+        from .utils.io import io2textfile
+
+        # no support for `include_nested` intended, so a temp file instead the original path is fine
+        rf = io2textfile(infile)
+        try:
+            return self._make_bom(
+                RequirementsFile.from_file(rf, include_nested=False).requirements
+            )
+        finally:
+            unlink(rf)
 
+    def _make_bom(self, requirements: Iterable['InstallRequirement']) -> 'Bom':
+        from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
-        from pip_requirements_parser import RequirementsFile  # type: ignore[import-untyped]
 
         from .utils.bom import make_bom
-        from .utils.io import io2textfile
 
         bom = make_bom()
 
-        # no support for `include_nested` intended, so a temp file instead the original path is fine
-        ff = io2textfile(infile)
-        try:
-            requirements = RequirementsFile.from_file(ff, include_nested=False).requirements
-        finally:
-            unlink(ff)
         for requirement in requirements:
+            name = requirement.name
             version = requirement.get_pinned_version or None
-            download_url = requirement.link and requirement.link.url or None
+            external_references = []
+            purl_qualifiers = {}  # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+
+            # workaround for https://github.com/nexB/pip-requirements-parser/issues/24
+            is_local = requirement.is_local_path and (not requirement.link or requirement.link.scheme in ['', 'file'])
+            if is_local:
+                if requirement.is_wheel or requirement.is_archive:
+                    purl_qualifiers['file_name'] = requirement.link.url
+                    try:
+                        external_references.append(ExternalReference(
+                            comment='local path to wheel/archive',
+                            type=ExternalReferenceType.OTHER,
+                            url=XsUri(requirement.link.url)))
+                    except InvalidUriException:
+                        pass  # safe to pass, as the actual line is documented as `description`
+            elif requirement.is_url:
+                if 'pythonhosted.org/' not in requirement.link.url:
+                    # skip PURL bloat, do not add implicit information
+                    purl_qualifiers['vcs_url' if requirement.is_vcs_url else 'download_url'] = requirement.link.url
+                try:
+                    external_references.append(ExternalReference(
+                        type=ExternalReferenceType.VCS if requirement.is_vcs_url else ExternalReferenceType.DISTRIBUTION,
+                        url=XsUri(requirement.link.url)))
+                except InvalidUriException:
+                    pass  # safe to pass, as the actual line is documented as `description`
+
             component = Component(
+                bom_ref=f'requirements-L{requirement.line_number}',
+                description=f'requirements line {requirement.line_number}: {requirement.line}',
                 type=ComponentType.LIBRARY,
-                name=requirement.name or 'unknown',
+                name=name or 'unknown',
                 version=version,
                 hashes=map(HashType.from_composite_str, requirement.hash_options),
                 purl=PackageURL(type='pypi', name=requirement.name, version=version,
-                                qualifiers=download_url and {'download_url': download_url}
-                                ) if requirement.name else None,
-                bom_ref=requirement.name or f'requirements#{requirement.line}',
-                external_references=[
-                    ExternalReference(type=ExternalReferenceType.DISTRIBUTION, url=XsUri(download_url))
-                ] if download_url else None
+                                qualifiers=purl_qualifiers
+                                ) if not is_local and name else None,
+                external_references=external_references,
             )
 
             self._logger.debug('Add component: %r', component)
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index e8d2294d..e3790a21 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -21,9 +21,6 @@
 
 from chardet import detect as chardetect
 
-if TYPE_CHECKING:  # pragma: no cover
-    from tempfile import _TemporaryFileWrapper
-
 
 def io2str(io: BinaryIO) -> str:
     data = io.read()
diff --git a/tests/__init__.py b/tests/__init__.py
index 3855b8dd..2428a260 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -26,7 +26,7 @@
 INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
 SNAPSHOTS_DIRECTORY = join(_TESTDATA_DIRECTORY, 'snapshots')
 
-RECREATE_SNAPSHOTS = '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
+RECREATE_SNAPSHOTS = True or '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
 if RECREATE_SNAPSHOTS:
     print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
 
diff --git a/tests/_data/infiles/requirements/local.txt b/tests/_data/infiles/requirements/local.txt
index 37ef5bea..de7d7fee 100644
--- a/tests/_data/infiles/requirements/local.txt
+++ b/tests/_data/infiles/requirements/local.txt
@@ -13,6 +13,8 @@
 # named
 foo @ file://../foo
 
-# unnamed
+# unnamed build distribution
 ./downloads/numpy-1.9.2-cp34-none-win32.whl
 
+# unnamed source distribution
+./downloads/numpy-1.26.1.tar.gz
diff --git a/tests/_data/infiles/requirements/with-hashes.txt b/tests/_data/infiles/requirements/with-hashes.txt
index cafa282f..632910af 100644
--- a/tests/_data/infiles/requirements/with-hashes.txt
+++ b/tests/_data/infiles/requirements/with-hashes.txt
@@ -1,11 +1,13 @@
 # hash mode -- https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode
 
+## oneliner
 certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8
 
-requests==2.25.1 \
-  --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804 \
-  --hash=sha256:c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e
-
-
+## unorthodox line breaks
 urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c \
  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098
+
+## typical line breaks
+FooProject == 1.2 \
+  --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 \
+  --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7
diff --git a/tests/_data/infiles/requirements/with-urls.txt b/tests/_data/infiles/requirements/with-urls.txt
index 784fab91..0e34d0a9 100644
--- a/tests/_data/infiles/requirements/with-urls.txt
+++ b/tests/_data/infiles/requirements/with-urls.txt
@@ -10,8 +10,12 @@ git+https://github.com/path/to/package-three@0.1#egg=package-three
 git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four
 
 
-# http
+# http build dist
 http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl
 
-# named
+# http source dist
+https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz
+
+
+# named repo ref
 urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin
index 17420085..fd1aada5 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin
@@ -4,6 +4,7 @@
     <component type="library">
       <name>FooProject</name>
       <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
       <hashes>
         <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
         <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -14,6 +15,7 @@
     <component type="library">
       <name>colorama</name>
       <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin
index 8bbfc7ae..78bd8599 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin
@@ -1,18 +1,20 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="FooProject">
+    <component type="library" bom-ref="requirements-L7">
       <name>FooProject</name>
       <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
       <hashes>
         <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
         <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
       </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
     </component>
-    <component type="library" bom-ref="colorama">
+    <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
       <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
index 5e0b286c..23fade1e 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
@@ -1,7 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "FooProject",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -18,7 +19,8 @@
       "version": "1.2"
     },
     {
-      "bom-ref": "colorama",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -27,10 +29,10 @@
   ],
   "dependencies": [
     {
-      "ref": "FooProject"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "colorama"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
index 880077b3..906ff006 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
@@ -2,23 +2,25 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="FooProject">
+    <component type="library" bom-ref="requirements-L7">
       <name>FooProject</name>
       <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
       <hashes>
         <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
         <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
       </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
     </component>
-    <component type="library" bom-ref="colorama">
+    <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
       <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="FooProject"/>
-    <dependency ref="colorama"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
index f8a7359f..458523ca 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
@@ -1,7 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "FooProject",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -18,7 +19,8 @@
       "version": "1.2"
     },
     {
-      "bom-ref": "colorama",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -27,10 +29,10 @@
   ],
   "dependencies": [
     {
-      "ref": "FooProject"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "colorama"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
index 6236c55b..53cb225e 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
@@ -2,23 +2,25 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="FooProject">
+    <component type="library" bom-ref="requirements-L7">
       <name>FooProject</name>
       <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
       <hashes>
         <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
         <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
       </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
     </component>
-    <component type="library" bom-ref="colorama">
+    <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
       <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="FooProject"/>
-    <dependency ref="colorama"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
index bf2fac12..ab372386 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
@@ -1,7 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "FooProject",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -18,7 +19,8 @@
       "version": "1.2"
     },
     {
-      "bom-ref": "colorama",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -27,10 +29,10 @@
   ],
   "dependencies": [
     {
-      "ref": "FooProject"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "colorama"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
index 8a1b8c75..fc697731 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
@@ -2,23 +2,25 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="FooProject">
+    <component type="library" bom-ref="requirements-L7">
       <name>FooProject</name>
       <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
       <hashes>
         <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
         <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
       </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
     </component>
-    <component type="library" bom-ref="colorama">
+    <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
       <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="FooProject"/>
-    <dependency ref="colorama"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.0.xml.bin
index 1fd12895..d3d94c13 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.0.xml.bin
@@ -4,23 +4,25 @@
     <component type="library">
       <name>foo</name>
       <version/>
-      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
+      <description>requirements line 14: foo @ file://../foo</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>numpy</name>
       <version>1.9.2</version>
-      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>unknown</name>
       <version/>
+      <description>requirements line 2: ./myproject/chardet</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>unknown</name>
       <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <hashes>
         <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
       </hashes>
@@ -29,6 +31,13 @@
     <component type="library">
       <name>unknown</name>
       <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml.bin
index d1327cc9..8cb425e1 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.1.xml.bin
@@ -1,53 +1,54 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="foo">
+    <component type="library" bom-ref="requirements-L14">
       <name>foo</name>
       <version/>
-      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>file://../foo</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 14: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="numpy">
+    <component type="library" bom-ref="requirements-L17">
       <name>numpy</name>
       <version>1.9.2</version>
-      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>unknown</name>
       <version/>
-      <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/chardet</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 2: ./myproject/chardet</description>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
+    <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <hashes>
         <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
       </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/requests</url>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
+    <component type="library" bom-ref="requirements-L20">
       <name>unknown</name>
       <version/>
+      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/idna.whl</url>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
index b3d412a6..13692cdd 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
@@ -1,51 +1,36 @@
 {
   "components": [
     {
-      "bom-ref": "foo",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "file://../foo"
-        }
-      ],
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: foo @ file://../foo",
       "name": "foo",
-      "purl": "pkg:pypi/foo?download_url=file://../foo",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "numpy",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "type": "distribution",
+          "comment": "local path to wheel/archive",
+          "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
       ],
       "name": "numpy",
-      "purl": "pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "type": "library",
       "version": "1.9.2"
     },
     {
-      "bom-ref": "requirements#./myproject/chardet",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "./myproject/chardet"
-        }
-      ],
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
       "name": "unknown",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "./myproject/requests"
-        }
-      ],
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -57,33 +42,52 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements#-e ./myproject/idna.whl",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "type": "distribution",
+          "comment": "local path to wheel/archive",
+          "type": "other",
           "url": "./myproject/idna.whl"
         }
       ],
       "name": "unknown",
       "type": "library",
       "version": ""
+    },
+    {
+      "bom-ref": "requirements-L20",
+      "description": "requirements line 20: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
     }
   ],
   "dependencies": [
     {
-      "ref": "foo"
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
     },
     {
-      "ref": "numpy"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "requirements#-e ./myproject/idna.whl"
+      "ref": "requirements-L20"
     },
     {
-      "ref": "requirements#./myproject/chardet"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
index a8a4b13d..6912257a 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
@@ -2,62 +2,64 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="foo">
+    <component type="library" bom-ref="requirements-L14">
       <name>foo</name>
       <version/>
-      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>file://../foo</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 14: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="numpy">
+    <component type="library" bom-ref="requirements-L17">
       <name>numpy</name>
       <version>1.9.2</version>
-      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>unknown</name>
       <version/>
-      <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/chardet</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 2: ./myproject/chardet</description>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
+    <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <hashes>
         <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
       </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/requests</url>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
+    <component type="library" bom-ref="requirements-L20">
       <name>unknown</name>
       <version/>
+      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/idna.whl</url>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="foo"/>
-    <dependency ref="numpy"/>
-    <dependency ref="requirements#-e ./myproject/idna.whl"/>
-    <dependency ref="requirements#./myproject/chardet"/>
-    <dependency ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L20"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
index 5ef00dcf..1403ac6f 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
@@ -1,51 +1,36 @@
 {
   "components": [
     {
-      "bom-ref": "foo",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "file://../foo"
-        }
-      ],
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: foo @ file://../foo",
       "name": "foo",
-      "purl": "pkg:pypi/foo?download_url=file://../foo",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "numpy",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "type": "distribution",
+          "comment": "local path to wheel/archive",
+          "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
       ],
       "name": "numpy",
-      "purl": "pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "type": "library",
       "version": "1.9.2"
     },
     {
-      "bom-ref": "requirements#./myproject/chardet",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "./myproject/chardet"
-        }
-      ],
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
       "name": "unknown",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "./myproject/requests"
-        }
-      ],
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -57,33 +42,52 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements#-e ./myproject/idna.whl",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "type": "distribution",
+          "comment": "local path to wheel/archive",
+          "type": "other",
           "url": "./myproject/idna.whl"
         }
       ],
       "name": "unknown",
       "type": "library",
       "version": ""
+    },
+    {
+      "bom-ref": "requirements-L20",
+      "description": "requirements line 20: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
     }
   ],
   "dependencies": [
     {
-      "ref": "foo"
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
     },
     {
-      "ref": "numpy"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "requirements#-e ./myproject/idna.whl"
+      "ref": "requirements-L20"
     },
     {
-      "ref": "requirements#./myproject/chardet"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
index 5ff79399..12ca425f 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
@@ -2,62 +2,64 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="foo">
+    <component type="library" bom-ref="requirements-L14">
       <name>foo</name>
       <version/>
-      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>file://../foo</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 14: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="numpy">
+    <component type="library" bom-ref="requirements-L17">
       <name>numpy</name>
       <version>1.9.2</version>
-      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>unknown</name>
       <version/>
-      <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/chardet</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 2: ./myproject/chardet</description>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
+    <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <hashes>
         <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
       </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/requests</url>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
+    <component type="library" bom-ref="requirements-L20">
       <name>unknown</name>
       <version/>
+      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/idna.whl</url>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="foo"/>
-    <dependency ref="numpy"/>
-    <dependency ref="requirements#-e ./myproject/idna.whl"/>
-    <dependency ref="requirements#./myproject/chardet"/>
-    <dependency ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L20"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
index 1007372c..fe878b89 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
@@ -1,49 +1,34 @@
 {
   "components": [
     {
-      "bom-ref": "foo",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "file://../foo"
-        }
-      ],
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: foo @ file://../foo",
       "name": "foo",
-      "purl": "pkg:pypi/foo?download_url=file://../foo",
       "type": "library"
     },
     {
-      "bom-ref": "numpy",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "type": "distribution",
+          "comment": "local path to wheel/archive",
+          "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
       ],
       "name": "numpy",
-      "purl": "pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "type": "library",
       "version": "1.9.2"
     },
     {
-      "bom-ref": "requirements#./myproject/chardet",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "./myproject/chardet"
-        }
-      ],
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
       "name": "unknown",
       "type": "library"
     },
     {
-      "bom-ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "./myproject/requests"
-        }
-      ],
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -54,32 +39,50 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements#-e ./myproject/idna.whl",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "type": "distribution",
+          "comment": "local path to wheel/archive",
+          "type": "other",
           "url": "./myproject/idna.whl"
         }
       ],
       "name": "unknown",
       "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L20",
+      "description": "requirements line 20: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
     }
   ],
   "dependencies": [
     {
-      "ref": "foo"
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
     },
     {
-      "ref": "numpy"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "requirements#-e ./myproject/idna.whl"
+      "ref": "requirements-L20"
     },
     {
-      "ref": "requirements#./myproject/chardet"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
index 968e8fb2..dac10331 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
@@ -2,58 +2,59 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="foo">
+    <component type="library" bom-ref="requirements-L14">
       <name>foo</name>
-      <purl>pkg:pypi/foo?download_url=file://../foo</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>file://../foo</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 14: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="numpy">
+    <component type="library" bom-ref="requirements-L17">
       <name>numpy</name>
       <version>1.9.2</version>
-      <purl>pkg:pypi/numpy@1.9.2?download_url=./downloads/numpy-1.9.2-cp34-none-win32.whl</purl>
+      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>unknown</name>
-      <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/chardet</url>
-        </reference>
-      </externalReferences>
+      <description>requirements line 2: ./myproject/chardet</description>
     </component>
-    <component type="library" bom-ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804">
+    <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <hashes>
         <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
       </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/requests</url>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements#-e ./myproject/idna.whl">
+    <component type="library" bom-ref="requirements-L20">
       <name>unknown</name>
+      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>./myproject/idna.whl</url>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="foo"/>
-    <dependency ref="numpy"/>
-    <dependency ref="requirements#-e ./myproject/idna.whl"/>
-    <dependency ref="requirements#./myproject/chardet"/>
-    <dependency ref="requirements#./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L20"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin
index d411ecbb..cf416381 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin
@@ -4,6 +4,7 @@
     <component type="library">
       <name>mypackage</name>
       <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin
index d8c8a3ae..c83955b8 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin
@@ -1,9 +1,10 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="mypackage">
+    <component type="library" bom-ref="requirements-L3">
       <name>mypackage</name>
       <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
index eabd5795..b1ba5c5f 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
@@ -1,7 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "mypackage",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -10,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "mypackage"
+      "ref": "requirements-L3"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
index 489686fe..6d55c304 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
@@ -2,13 +2,14 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="mypackage">
+    <component type="library" bom-ref="requirements-L3">
       <name>mypackage</name>
       <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="mypackage"/>
+    <dependency ref="requirements-L3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
index 2fd94ab5..07107ac6 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
@@ -1,7 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "mypackage",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -10,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "mypackage"
+      "ref": "requirements-L3"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
index 9c790643..bededbaa 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
@@ -2,13 +2,14 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="mypackage">
+    <component type="library" bom-ref="requirements-L3">
       <name>mypackage</name>
       <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="mypackage"/>
+    <dependency ref="requirements-L3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
index 0f67a11a..d57ef197 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
@@ -1,7 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "mypackage",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -10,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "mypackage"
+      "ref": "requirements-L3"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
index dc651080..3f4bb011 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
@@ -2,13 +2,14 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="mypackage">
+    <component type="library" bom-ref="requirements-L3">
       <name>mypackage</name>
       <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="mypackage"/>
+    <dependency ref="requirements-L3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin
index 1ad2c86c..5382704a 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin
@@ -4,18 +4,21 @@
     <component type="library">
       <name>packageurl-python</name>
       <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>requirements_parser</name>
       <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>setuptools</name>
       <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin
index a7b87c4a..4a2e049e 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin
@@ -1,19 +1,22 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="packageurl-python">
+    <component type="library" bom-ref="requirements-L6">
       <name>packageurl-python</name>
       <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
     </component>
-    <component type="library" bom-ref="requirements_parser">
+    <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
       <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
     </component>
-    <component type="library" bom-ref="setuptools">
+    <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
       <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
index 3da5b44c..07409c15 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
@@ -1,21 +1,24 @@
 {
   "components": [
     {
-      "bom-ref": "packageurl-python",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
       "name": "packageurl-python",
       "purl": "pkg:pypi/packageurl-python",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "requirements_parser",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
       "name": "requirements_parser",
       "purl": "pkg:pypi/requirements-parser",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "setuptools",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
       "name": "setuptools",
       "purl": "pkg:pypi/setuptools",
       "type": "library",
@@ -24,13 +27,13 @@
   ],
   "dependencies": [
     {
-      "ref": "packageurl-python"
+      "ref": "requirements-L6"
     },
     {
-      "ref": "requirements_parser"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "setuptools"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
index 56b1b929..39535bb7 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
@@ -2,25 +2,28 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="packageurl-python">
+    <component type="library" bom-ref="requirements-L6">
       <name>packageurl-python</name>
       <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
     </component>
-    <component type="library" bom-ref="requirements_parser">
+    <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
       <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
     </component>
-    <component type="library" bom-ref="setuptools">
+    <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
       <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="packageurl-python"/>
-    <dependency ref="requirements_parser"/>
-    <dependency ref="setuptools"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
index fbaa1aed..3920a1d5 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
@@ -1,21 +1,24 @@
 {
   "components": [
     {
-      "bom-ref": "packageurl-python",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
       "name": "packageurl-python",
       "purl": "pkg:pypi/packageurl-python",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "requirements_parser",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
       "name": "requirements_parser",
       "purl": "pkg:pypi/requirements-parser",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "setuptools",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
       "name": "setuptools",
       "purl": "pkg:pypi/setuptools",
       "type": "library",
@@ -24,13 +27,13 @@
   ],
   "dependencies": [
     {
-      "ref": "packageurl-python"
+      "ref": "requirements-L6"
     },
     {
-      "ref": "requirements_parser"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "setuptools"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
index 8ece8595..3a93100c 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
@@ -2,25 +2,28 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="packageurl-python">
+    <component type="library" bom-ref="requirements-L6">
       <name>packageurl-python</name>
       <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
     </component>
-    <component type="library" bom-ref="requirements_parser">
+    <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
       <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
     </component>
-    <component type="library" bom-ref="setuptools">
+    <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
       <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="packageurl-python"/>
-    <dependency ref="requirements_parser"/>
-    <dependency ref="setuptools"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
index 03f83ca0..fdfe5d29 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
@@ -1,19 +1,22 @@
 {
   "components": [
     {
-      "bom-ref": "packageurl-python",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
       "name": "packageurl-python",
       "purl": "pkg:pypi/packageurl-python",
       "type": "library"
     },
     {
-      "bom-ref": "requirements_parser",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
       "name": "requirements_parser",
       "purl": "pkg:pypi/requirements-parser",
       "type": "library"
     },
     {
-      "bom-ref": "setuptools",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
       "name": "setuptools",
       "purl": "pkg:pypi/setuptools",
       "type": "library"
@@ -21,13 +24,13 @@
   ],
   "dependencies": [
     {
-      "ref": "packageurl-python"
+      "ref": "requirements-L6"
     },
     {
-      "ref": "requirements_parser"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "setuptools"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
index 64d80578..8e9399ab 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
@@ -2,22 +2,25 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="packageurl-python">
+    <component type="library" bom-ref="requirements-L6">
       <name>packageurl-python</name>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
     </component>
-    <component type="library" bom-ref="requirements_parser">
+    <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
     </component>
-    <component type="library" bom-ref="setuptools">
+    <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="packageurl-python"/>
-    <dependency ref="requirements_parser"/>
-    <dependency ref="setuptools"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin
index 4e37b13f..8302ef11 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin
@@ -4,30 +4,35 @@
     <component type="library">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>chardet</name>
       <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>idna</name>
       <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>requests</name>
       <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin
index 45c0ff12..e173155c 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin
@@ -1,29 +1,34 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
     </component>
-    <component type="library" bom-ref="idna">
+    <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
     </component>
-    <component type="library" bom-ref="requests">
+    <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
index be7e1b98..e29f5798 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
@@ -1,35 +1,40 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "chardet",
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
       "version": "4.0.0"
     },
     {
-      "bom-ref": "idna",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
       "version": "2.10"
     },
     {
-      "bom-ref": "requests",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
       "version": "2.25.1"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
@@ -38,19 +43,19 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L1"
     },
     {
-      "ref": "chardet"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "idna"
+      "ref": "requirements-L3"
     },
     {
-      "ref": "requests"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
index 9c0754b1..3dbd5d9b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
@@ -2,37 +2,42 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
     </component>
-    <component type="library" bom-ref="idna">
+    <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
     </component>
-    <component type="library" bom-ref="requests">
+    <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="chardet"/>
-    <dependency ref="idna"/>
-    <dependency ref="requests"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
index fa37b818..7add9eb7 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
@@ -1,35 +1,40 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "chardet",
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
       "version": "4.0.0"
     },
     {
-      "bom-ref": "idna",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
       "version": "2.10"
     },
     {
-      "bom-ref": "requests",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
       "version": "2.25.1"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
@@ -38,19 +43,19 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L1"
     },
     {
-      "ref": "chardet"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "idna"
+      "ref": "requirements-L3"
     },
     {
-      "ref": "requests"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
index cd56db49..9af0eb1c 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
@@ -2,37 +2,42 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
     </component>
-    <component type="library" bom-ref="idna">
+    <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
     </component>
-    <component type="library" bom-ref="requests">
+    <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="chardet"/>
-    <dependency ref="idna"/>
-    <dependency ref="requests"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
index 844a1581..35ad6d3a 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
@@ -1,35 +1,40 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "chardet",
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
       "version": "4.0.0"
     },
     {
-      "bom-ref": "idna",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
       "version": "2.10"
     },
     {
-      "bom-ref": "requests",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
       "version": "2.25.1"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
@@ -38,19 +43,19 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L1"
     },
     {
-      "ref": "chardet"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "idna"
+      "ref": "requirements-L3"
     },
     {
-      "ref": "requests"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
index 7b6d0fd0..fa80b80e 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
@@ -2,37 +2,42 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
     </component>
-    <component type="library" bom-ref="idna">
+    <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
     </component>
-    <component type="library" bom-ref="requests">
+    <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="chardet"/>
-    <dependency ref="idna"/>
-    <dependency ref="requests"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin
index ab156af4..6a66d014 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin
@@ -2,28 +2,31 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
   <components>
     <component type="library">
-      <name>certifi</name>
-      <version>2021.5.30</version>
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
       <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
       </hashes>
-      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <purl>pkg:pypi/fooproject@1.2</purl>
       <modified>false</modified>
     </component>
     <component type="library">
-      <name>requests</name>
-      <version>2.25.1</version>
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
       <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
       </hashes>
-      <purl>pkg:pypi/requests@2.25.1</purl>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
       <hashes>
         <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
         <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin
index a6132456..c799a12b 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin
@@ -1,27 +1,30 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
       <hashes>
         <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
         <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
       </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="requests">
-      <name>requests</name>
-      <version>2.25.1</version>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
-      </hashes>
-      <purl>pkg:pypi/requests@2.25.1</purl>
-    </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
       <hashes>
         <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
         <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
index 987d521f..5c7b7a65 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
@@ -1,41 +1,44 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
         },
         {
           "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
         }
       ],
-      "name": "certifi",
-      "purl": "pkg:pypi/certifi@2021.5.30",
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
       "type": "library",
-      "version": "2021.5.30"
+      "version": "1.2"
     },
     {
-      "bom-ref": "requests",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
         },
         {
           "alg": "SHA-256",
-          "content": "c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
         }
       ],
-      "name": "requests",
-      "purl": "pkg:pypi/requests@2.25.1",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
-      "version": "2.25.1"
+      "version": "2021.5.30"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -54,13 +57,13 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requests"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
index 1f3e01f1..dc1d48e0 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
@@ -2,27 +2,30 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
       <hashes>
         <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
         <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
       </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="requests">
-      <name>requests</name>
-      <version>2.25.1</version>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
-      </hashes>
-      <purl>pkg:pypi/requests@2.25.1</purl>
-    </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
       <hashes>
         <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
         <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
@@ -31,8 +34,8 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="requests"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
index c36578c5..3f672923 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
@@ -1,41 +1,44 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
         },
         {
           "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
         }
       ],
-      "name": "certifi",
-      "purl": "pkg:pypi/certifi@2021.5.30",
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
       "type": "library",
-      "version": "2021.5.30"
+      "version": "1.2"
     },
     {
-      "bom-ref": "requests",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
         },
         {
           "alg": "SHA-256",
-          "content": "c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
         }
       ],
-      "name": "requests",
-      "purl": "pkg:pypi/requests@2.25.1",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
-      "version": "2.25.1"
+      "version": "2021.5.30"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -54,13 +57,13 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requests"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
index 6dc43b8a..80e6a2d1 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
@@ -2,27 +2,30 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
       <hashes>
         <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
         <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
       </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="requests">
-      <name>requests</name>
-      <version>2.25.1</version>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
-      </hashes>
-      <purl>pkg:pypi/requests@2.25.1</purl>
-    </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
       <hashes>
         <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
         <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
@@ -31,8 +34,8 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="requests"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
index d291d844..25a94d54 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
@@ -1,41 +1,44 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
         },
         {
           "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
         }
       ],
-      "name": "certifi",
-      "purl": "pkg:pypi/certifi@2021.5.30",
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
       "type": "library",
-      "version": "2021.5.30"
+      "version": "1.2"
     },
     {
-      "bom-ref": "requests",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
         },
         {
           "alg": "SHA-256",
-          "content": "c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e"
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
         }
       ],
-      "name": "requests",
-      "purl": "pkg:pypi/requests@2.25.1",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
-      "version": "2.25.1"
+      "version": "2021.5.30"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "hashes": [
         {
           "alg": "SHA-256",
@@ -54,13 +57,13 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requests"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
index 297f61b7..2f7ac2a0 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
@@ -2,27 +2,30 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
       <hashes>
         <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
         <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
       </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
     </component>
-    <component type="library" bom-ref="requests">
-      <name>requests</name>
-      <version>2.25.1</version>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-        <hash alg="SHA-256">c210084e36a42ae6b9219e00e48287def368a26d03a048ddad7bfee44f75871e</hash>
-      </hashes>
-      <purl>pkg:pypi/requests@2.25.1</purl>
-    </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
       <hashes>
         <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
         <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
@@ -31,8 +34,8 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="requests"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin
index bee58c95..297d7b08 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin
@@ -4,36 +4,48 @@
     <component type="library">
       <name>package-four</name>
       <version/>
-      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-one</name>
       <version/>
-      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-three</name>
       <version/>
-      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-two</name>
       <version/>
-      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin
index 8ce64d86..75846370 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin
@@ -1,49 +1,64 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="package-four">
+    <component type="library" bom-ref="requirements-L10">
       <name>package-four</name>
       <version/>
-      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-one">
+    <component type="library" bom-ref="requirements-L4">
       <name>package-one</name>
       <version/>
-      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-three">
+    <component type="library" bom-ref="requirements-L8">
       <name>package-three</name>
       <version/>
-      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-two">
+    <component type="library" bom-ref="requirements-L6">
       <name>package-two</name>
       <version/>
-      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
@@ -51,9 +66,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="wxPython-Phoenix">
+    <component type="library" bom-ref="requirements-L14">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
index 1a3f932d..85204af4 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
@@ -1,59 +1,77 @@
 {
   "components": [
     {
-      "bom-ref": "package-four",
+      "bom-ref": "requirements-L10",
+      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
       ],
       "name": "package-four",
-      "purl": "pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "package-one",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
       ],
       "name": "package-one",
-      "purl": "pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "package-three",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
       ],
       "name": "package-three",
-      "purl": "pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "package-two",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
       ],
       "name": "package-two",
-      "purl": "pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
           "type": "distribution",
@@ -66,7 +84,8 @@
       "version": ""
     },
     {
-      "bom-ref": "wxPython-Phoenix",
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
           "type": "distribution",
@@ -81,22 +100,25 @@
   ],
   "dependencies": [
     {
-      "ref": "package-four"
+      "ref": "requirements-L10"
+    },
+    {
+      "ref": "requirements-L14"
     },
     {
-      "ref": "package-one"
+      "ref": "requirements-L17"
     },
     {
-      "ref": "package-three"
+      "ref": "requirements-L21"
     },
     {
-      "ref": "package-two"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L6"
     },
     {
-      "ref": "wxPython-Phoenix"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
index 41cfcc63..2ea24e0d 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
@@ -2,49 +2,64 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="package-four">
+    <component type="library" bom-ref="requirements-L10">
       <name>package-four</name>
       <version/>
-      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-one">
+    <component type="library" bom-ref="requirements-L4">
       <name>package-one</name>
       <version/>
-      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-three">
+    <component type="library" bom-ref="requirements-L8">
       <name>package-three</name>
       <version/>
-      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-two">
+    <component type="library" bom-ref="requirements-L6">
       <name>package-two</name>
       <version/>
-      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
@@ -52,9 +67,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="wxPython-Phoenix">
+    <component type="library" bom-ref="requirements-L14">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
@@ -64,11 +80,12 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="package-four"/>
-    <dependency ref="package-one"/>
-    <dependency ref="package-three"/>
-    <dependency ref="package-two"/>
-    <dependency ref="urllib3"/>
-    <dependency ref="wxPython-Phoenix"/>
+    <dependency ref="requirements-L10"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
index 39b11b62..3e26e002 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
@@ -1,59 +1,77 @@
 {
   "components": [
     {
-      "bom-ref": "package-four",
+      "bom-ref": "requirements-L10",
+      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
       ],
       "name": "package-four",
-      "purl": "pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "package-one",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
       ],
       "name": "package-one",
-      "purl": "pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "package-three",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
       ],
       "name": "package-three",
-      "purl": "pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "package-two",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
       ],
       "name": "package-two",
-      "purl": "pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
           "type": "distribution",
@@ -66,7 +84,8 @@
       "version": ""
     },
     {
-      "bom-ref": "wxPython-Phoenix",
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
           "type": "distribution",
@@ -81,22 +100,25 @@
   ],
   "dependencies": [
     {
-      "ref": "package-four"
+      "ref": "requirements-L10"
+    },
+    {
+      "ref": "requirements-L14"
     },
     {
-      "ref": "package-one"
+      "ref": "requirements-L17"
     },
     {
-      "ref": "package-three"
+      "ref": "requirements-L21"
     },
     {
-      "ref": "package-two"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L6"
     },
     {
-      "ref": "wxPython-Phoenix"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
index 9ca5e800..a759d60c 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
@@ -2,49 +2,64 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="package-four">
+    <component type="library" bom-ref="requirements-L10">
       <name>package-four</name>
       <version/>
-      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-one">
+    <component type="library" bom-ref="requirements-L4">
       <name>package-one</name>
       <version/>
-      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-three">
+    <component type="library" bom-ref="requirements-L8">
       <name>package-three</name>
       <version/>
-      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-two">
+    <component type="library" bom-ref="requirements-L6">
       <name>package-two</name>
       <version/>
-      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
@@ -52,9 +67,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="wxPython-Phoenix">
+    <component type="library" bom-ref="requirements-L14">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
@@ -64,11 +80,12 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="package-four"/>
-    <dependency ref="package-one"/>
-    <dependency ref="package-three"/>
-    <dependency ref="package-two"/>
-    <dependency ref="urllib3"/>
-    <dependency ref="wxPython-Phoenix"/>
+    <dependency ref="requirements-L10"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
index d7779da4..6df146fd 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
@@ -1,55 +1,72 @@
 {
   "components": [
     {
-      "bom-ref": "package-four",
+      "bom-ref": "requirements-L10",
+      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
       ],
       "name": "package-four",
-      "purl": "pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
       "type": "library"
     },
     {
-      "bom-ref": "package-one",
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
       ],
       "name": "package-one",
-      "purl": "pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
       "type": "library"
     },
     {
-      "bom-ref": "package-three",
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
       ],
       "name": "package-three",
-      "purl": "pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
       "type": "library"
     },
     {
-      "bom-ref": "package-two",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
-          "type": "distribution",
+          "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
       ],
       "name": "package-two",
-      "purl": "pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
       "type": "library"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
           "type": "distribution",
@@ -61,7 +78,8 @@
       "type": "library"
     },
     {
-      "bom-ref": "wxPython-Phoenix",
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
           "type": "distribution",
@@ -76,22 +94,25 @@
   ],
   "dependencies": [
     {
-      "ref": "package-four"
+      "ref": "requirements-L10"
+    },
+    {
+      "ref": "requirements-L14"
     },
     {
-      "ref": "package-one"
+      "ref": "requirements-L17"
     },
     {
-      "ref": "package-three"
+      "ref": "requirements-L21"
     },
     {
-      "ref": "package-two"
+      "ref": "requirements-L4"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L6"
     },
     {
-      "ref": "wxPython-Phoenix"
+      "ref": "requirements-L8"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
index 19f22965..90987fd4 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
@@ -2,44 +2,58 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="package-four">
+    <component type="library" bom-ref="requirements-L10">
       <name>package-four</name>
-      <purl>pkg:pypi/package-four?download_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-one">
+    <component type="library" bom-ref="requirements-L4">
       <name>package-one</name>
-      <purl>pkg:pypi/package-one?download_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-three">
+    <component type="library" bom-ref="requirements-L8">
       <name>package-three</name>
-      <purl>pkg:pypi/package-three?download_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-two">
+    <component type="library" bom-ref="requirements-L6">
       <name>package-two</name>
-      <purl>pkg:pypi/package-two?download_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
-        <reference type="distribution">
+        <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
       <name>urllib3</name>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
@@ -47,9 +61,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="wxPython-Phoenix">
+    <component type="library" bom-ref="requirements-L14">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
@@ -59,11 +74,12 @@
     </component>
   </components>
   <dependencies>
-    <dependency ref="package-four"/>
-    <dependency ref="package-one"/>
-    <dependency ref="package-three"/>
-    <dependency ref="package-two"/>
-    <dependency ref="urllib3"/>
-    <dependency ref="wxPython-Phoenix"/>
+    <dependency ref="requirements-L10"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L8"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin
index 9c95e3c2..2c1666d8 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin
@@ -4,18 +4,21 @@
     <component type="library">
       <name>certifi</name>
       <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>chardet</name>
       <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin
index dd3b4825..af722b57 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin
@@ -1,19 +1,22 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
       <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
index 60b8e1bf..41afefee 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
@@ -1,21 +1,24 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "chardet",
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library",
@@ -24,13 +27,13 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L1"
     },
     {
-      "ref": "chardet"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L3"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
index 7c86e50e..9f624533 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
@@ -2,25 +2,28 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
       <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="chardet"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
index bd6195ee..24bf1e4f 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
@@ -1,21 +1,24 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "chardet",
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library",
@@ -24,13 +27,13 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L1"
     },
     {
-      "ref": "chardet"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L3"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
index b0dea118..a1bc1595 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
@@ -2,25 +2,28 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
       <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
+      <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="chardet"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
index fdba7510..e7c18286 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
@@ -1,19 +1,22 @@
 {
   "components": [
     {
-      "bom-ref": "certifi",
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library"
     },
     {
-      "bom-ref": "chardet",
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library"
     },
     {
-      "bom-ref": "urllib3",
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library"
@@ -21,13 +24,13 @@
   ],
   "dependencies": [
     {
-      "ref": "certifi"
+      "ref": "requirements-L1"
     },
     {
-      "ref": "chardet"
+      "ref": "requirements-L2"
     },
     {
-      "ref": "urllib3"
+      "ref": "requirements-L3"
     }
   ],
   "metadata": {},
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
index d215a5cd..05303fc9 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
@@ -2,22 +2,25 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
   <metadata/>
   <components>
-    <component type="library" bom-ref="certifi">
+    <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
     </component>
-    <component type="library" bom-ref="chardet">
+    <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
     </component>
-    <component type="library" bom-ref="urllib3">
+    <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
+      <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="certifi"/>
-    <dependency ref="chardet"/>
-    <dependency ref="urllib3"/>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
   </dependencies>
 </bom>
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index df58003e..6416ccad 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -16,12 +16,10 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-import re
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob
 from io import StringIO
 from os.path import basename, join
-from typing import Union
 from unittest import TestCase
 from unittest.mock import patch
 

From f9ec061149d806cbbe1d33d0100301e53bf59fbd Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 15:10:00 +0100
Subject: [PATCH 036/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 97660d93..560eb5a5 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -26,7 +26,7 @@
     from logging import Logger
 
     from cyclonedx.model.bom import Bom
-    from pip_requirements_parser import InstallRequirement
+    from pip_requirements_parser import InstallRequirement  # type:ignore[import-untyped]
 
 
 # !!! be as lazy loading as possible, as greedy as needed
@@ -69,7 +69,7 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  infile: BinaryIO,
                  **kwargs: Any) -> 'Bom':
-        from pip_requirements_parser import RequirementsFile  # type: ignore[import-untyped]
+        from pip_requirements_parser import RequirementsFile
 
         from .utils.io import io2textfile
 

From ae41cc6bb4347107b531e2669dca9af9ad4bca18 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 15:16:12 +0100
Subject: [PATCH 037/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 95 +++++++++++++-------------
 cyclonedx_py/_internal/utils/io.py     |  2 +-
 tests/__init__.py                      |  2 +-
 3 files changed, 51 insertions(+), 48 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 560eb5a5..8da1e015 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -26,6 +26,7 @@
     from logging import Logger
 
     from cyclonedx.model.bom import Bom
+    from cyclonedx.model.component import Component
     from pip_requirements_parser import InstallRequirement  # type:ignore[import-untyped]
 
 
@@ -83,60 +84,62 @@ def __call__(self, *,  # type:ignore[override]
             unlink(rf)
 
     def _make_bom(self, requirements: Iterable['InstallRequirement']) -> 'Bom':
-        from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
-        from cyclonedx.model.component import Component, ComponentType
-        from packageurl import PackageURL
-
         from .utils.bom import make_bom
 
         bom = make_bom()
 
         for requirement in requirements:
-            name = requirement.name
-            version = requirement.get_pinned_version or None
-            external_references = []
-            purl_qualifiers = {}  # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
-
-            # workaround for https://github.com/nexB/pip-requirements-parser/issues/24
-            is_local = requirement.is_local_path and (not requirement.link or requirement.link.scheme in ['', 'file'])
-            if is_local:
-                if requirement.is_wheel or requirement.is_archive:
-                    purl_qualifiers['file_name'] = requirement.link.url
-                    try:
-                        external_references.append(ExternalReference(
-                            comment='local path to wheel/archive',
-                            type=ExternalReferenceType.OTHER,
-                            url=XsUri(requirement.link.url)))
-                    except InvalidUriException:
-                        pass  # safe to pass, as the actual line is documented as `description`
-            elif requirement.is_url:
-                if 'pythonhosted.org/' not in requirement.link.url:
-                    # skip PURL bloat, do not add implicit information
-                    purl_qualifiers['vcs_url' if requirement.is_vcs_url else 'download_url'] = requirement.link.url
-                try:
-                    external_references.append(ExternalReference(
-                        type=ExternalReferenceType.VCS if requirement.is_vcs_url else ExternalReferenceType.DISTRIBUTION,
-                        url=XsUri(requirement.link.url)))
-                except InvalidUriException:
-                    pass  # safe to pass, as the actual line is documented as `description`
-
-            component = Component(
-                bom_ref=f'requirements-L{requirement.line_number}',
-                description=f'requirements line {requirement.line_number}: {requirement.line}',
-                type=ComponentType.LIBRARY,
-                name=name or 'unknown',
-                version=version,
-                hashes=map(HashType.from_composite_str, requirement.hash_options),
-                purl=PackageURL(type='pypi', name=requirement.name, version=version,
-                                qualifiers=purl_qualifiers
-                                ) if not is_local and name else None,
-                external_references=external_references,
-            )
-
+            component = self.__make_component(requirement)
             self._logger.debug('Add component: %r', component)
             if not component.version:
                 self._logger.warning('Component has no version: %r', component)
             bom.components.add(component)
 
         return bom
+
+    def __make_component(self, req: 'InstallRequirement') -> 'Component':
+        from cyclonedx.exception.model import InvalidUriException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+        from cyclonedx.model.component import Component, ComponentType
+        from packageurl import PackageURL
+
+        name = req.name
+        version = req.get_pinned_version or None
+        external_references = []
+        purl_qualifiers = {}  # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+
+        # workaround for https://github.com/nexB/pip-requirements-parser/issues/24
+        is_local = req.is_local_path and (not req.link or req.link.scheme in ['', 'file'])
+        if is_local:
+            if req.is_wheel or req.is_archive:
+                purl_qualifiers['file_name'] = req.link.url
+                try:
+                    external_references.append(ExternalReference(
+                        comment='local path to wheel/archive',
+                        type=ExternalReferenceType.OTHER,
+                        url=XsUri(req.link.url)))
+                except InvalidUriException:
+                    pass  # safe to pass, as the actual line is documented as `description`
+        elif req.is_url:
+            if 'pythonhosted.org/' not in req.link.url:
+                # skip PURL bloat, do not add implicit information
+                purl_qualifiers['vcs_url' if req.is_vcs_url else 'download_url'] = req.link.url
+            try:
+                external_references.append(ExternalReference(
+                    type=ExternalReferenceType.VCS if req.is_vcs_url else ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(req.link.url)))
+            except InvalidUriException:
+                pass  # safe to pass, as the actual line is documented as `description`
+
+        return Component(
+            bom_ref=f'requirements-L{req.line_number}',
+            description=f'requirements line {req.line_number}: {req.line}',
+            type=ComponentType.LIBRARY,
+            name=name or 'unknown',
+            version=version,
+            hashes=map(HashType.from_composite_str, req.hash_options),
+            purl=PackageURL(type='pypi', name=req.name, version=version,
+                            qualifiers=purl_qualifiers
+                            ) if not is_local and name else None,
+            external_references=external_references,
+        )
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index e3790a21..2d2fc2ee 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -17,7 +17,7 @@
 
 
 from tempfile import NamedTemporaryFile
-from typing import TYPE_CHECKING, BinaryIO
+from typing import BinaryIO
 
 from chardet import detect as chardetect
 
diff --git a/tests/__init__.py b/tests/__init__.py
index 2428a260..3855b8dd 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -26,7 +26,7 @@
 INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
 SNAPSHOTS_DIRECTORY = join(_TESTDATA_DIRECTORY, 'snapshots')
 
-RECREATE_SNAPSHOTS = True or '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
+RECREATE_SNAPSHOTS = '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
 if RECREATE_SNAPSHOTS:
     print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
 

From e85034acf32e7d95ab76ea209404bb7a98df4108 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 18:48:46 +0100
Subject: [PATCH 038/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/utils/io.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index 2d2fc2ee..a93b9f44 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -32,7 +32,8 @@ def io2str(io: BinaryIO) -> str:
 
 def io2textfile(io: BinaryIO) -> str:
     # prevent issues on windows: https://github.com/python/cpython/issues/58451
-    tf = NamedTemporaryFile('wt', encoding='utf8', delete=False)
+    tf = NamedTemporaryFile('wt', delete=False,
+                            encoding='utf8', newline='\n')
     tf.write(io2str(io))
     tf.close()
     return tf.name

From 8e41ee392b5cdd5a3c810c9fe26214fb5b370f0b Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 19:16:56 +0100
Subject: [PATCH 039/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 4 ++--
 cyclonedx_py/_internal/utils/io.py     | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 8da1e015..448fd2a5 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -72,10 +72,10 @@ def __call__(self, *,  # type:ignore[override]
                  **kwargs: Any) -> 'Bom':
         from pip_requirements_parser import RequirementsFile
 
-        from .utils.io import io2textfile
+        from .utils.io import io2file
 
         # no support for `include_nested` intended, so a temp file instead the original path is fine
-        rf = io2textfile(infile)
+        rf = io2file(infile)
         try:
             return self._make_bom(
                 RequirementsFile.from_file(rf, include_nested=False).requirements
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index a93b9f44..dd0bdd10 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -30,10 +30,9 @@ def io2str(io: BinaryIO) -> str:
     return data.decode(encoding)
 
 
-def io2textfile(io: BinaryIO) -> str:
+def io2file(io: BinaryIO) -> str:
     # prevent issues on windows: https://github.com/python/cpython/issues/58451
-    tf = NamedTemporaryFile('wt', delete=False,
-                            encoding='utf8', newline='\n')
-    tf.write(io2str(io))
+    tf = NamedTemporaryFile('wb', delete=False)
+    tf.write(io.read())
     tf.close()
     return tf.name

From 20035f417743b95a6c80ca9edbf36bf18d76e4a1 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 1 Nov 2023 20:59:51 +0100
Subject: [PATCH 040/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/utils/io.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index dd0bdd10..b2055e15 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -32,7 +32,11 @@ def io2str(io: BinaryIO) -> str:
 
 def io2file(io: BinaryIO) -> str:
     # prevent issues on windows: https://github.com/python/cpython/issues/58451
-    tf = NamedTemporaryFile('wb', delete=False)
-    tf.write(io.read())
+    tf = NamedTemporaryFile('wt', delete=False,
+                            # we prefer utf8 encoded strings, but ...
+                            # - must not change newlines
+                            # - must not  change encoding, fallback to system encoding for compatibility
+                            newline='', encoding=None)
+    tf.write(io2str(io))
     tf.close()
     return tf.name

From bb61c9d9c54ee036b42b579fc40d2be5f7cb42ef Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 2 Nov 2023 13:04:18 +0100
Subject: [PATCH 041/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/__main__.py                      |  4 +-
 cyclonedx_py/_internal/cli.py                 |  2 +-
 cyclonedx_py/_internal/utils/bom.py           | 44 +++++++++-
 cyclonedx_py/_internal/utils/io.py            |  2 +-
 poetry.lock                                   |  8 +-
 pyproject.toml                                |  2 +-
 tests/__init__.py                             | 61 +++++++++++++-
 .../requirements/frozen.txt-1.2.json.bin      | 15 +++-
 .../requirements/frozen.txt-1.2.xml.bin       | 15 +++-
 .../requirements/frozen.txt-1.3.json.bin      | 15 +++-
 .../requirements/frozen.txt-1.3.xml.bin       | 15 +++-
 .../requirements/frozen.txt-1.4.json.bin      | 83 ++++++++++++++++++-
 .../requirements/frozen.txt-1.4.xml.bin       | 67 ++++++++++++++-
 .../requirements/local.txt-1.2.json.bin       | 15 +++-
 .../requirements/local.txt-1.2.xml.bin        | 15 +++-
 .../requirements/local.txt-1.3.json.bin       | 15 +++-
 .../requirements/local.txt-1.3.xml.bin        | 15 +++-
 .../requirements/local.txt-1.4.json.bin       | 83 ++++++++++++++++++-
 .../requirements/local.txt-1.4.xml.bin        | 67 ++++++++++++++-
 .../private-packages.txt-1.2.json.bin         | 15 +++-
 .../private-packages.txt-1.2.xml.bin          | 15 +++-
 .../private-packages.txt-1.3.json.bin         | 15 +++-
 .../private-packages.txt-1.3.xml.bin          | 15 +++-
 .../private-packages.txt-1.4.json.bin         | 83 ++++++++++++++++++-
 .../private-packages.txt-1.4.xml.bin          | 67 ++++++++++++++-
 ...ssion-issue448.cp1252.txt.bin-1.2.json.bin | 15 +++-
 ...ession-issue448.cp1252.txt.bin-1.2.xml.bin | 15 +++-
 ...ssion-issue448.cp1252.txt.bin-1.3.json.bin | 15 +++-
 ...ession-issue448.cp1252.txt.bin-1.3.xml.bin | 15 +++-
 ...ssion-issue448.cp1252.txt.bin-1.4.json.bin | 83 ++++++++++++++++++-
 ...ession-issue448.cp1252.txt.bin-1.4.xml.bin | 67 ++++++++++++++-
 .../with-comments.txt-1.2.json.bin            | 15 +++-
 .../with-comments.txt-1.2.xml.bin             | 15 +++-
 .../with-comments.txt-1.3.json.bin            | 15 +++-
 .../with-comments.txt-1.3.xml.bin             | 15 +++-
 .../with-comments.txt-1.4.json.bin            | 83 ++++++++++++++++++-
 .../with-comments.txt-1.4.xml.bin             | 67 ++++++++++++++-
 .../requirements/with-hashes.txt-1.2.json.bin | 15 +++-
 .../requirements/with-hashes.txt-1.2.xml.bin  | 15 +++-
 .../requirements/with-hashes.txt-1.3.json.bin | 15 +++-
 .../requirements/with-hashes.txt-1.3.xml.bin  | 15 +++-
 .../requirements/with-hashes.txt-1.4.json.bin | 83 ++++++++++++++++++-
 .../requirements/with-hashes.txt-1.4.xml.bin  | 67 ++++++++++++++-
 .../requirements/with-urls.txt-1.2.json.bin   | 15 +++-
 .../requirements/with-urls.txt-1.2.xml.bin    | 15 +++-
 .../requirements/with-urls.txt-1.3.json.bin   | 15 +++-
 .../requirements/with-urls.txt-1.3.xml.bin    | 15 +++-
 .../requirements/with-urls.txt-1.4.json.bin   | 83 ++++++++++++++++++-
 .../requirements/with-urls.txt-1.4.xml.bin    | 67 ++++++++++++++-
 .../without-pinned-versions.txt-1.2.json.bin  | 15 +++-
 .../without-pinned-versions.txt-1.2.xml.bin   | 15 +++-
 .../without-pinned-versions.txt-1.3.json.bin  | 15 +++-
 .../without-pinned-versions.txt-1.3.xml.bin   | 15 +++-
 .../without-pinned-versions.txt-1.4.json.bin  | 83 ++++++++++++++++++-
 .../without-pinned-versions.txt-1.4.xml.bin   | 67 ++++++++++++++-
 tests/integration/test_requirements.py        | 23 ++---
 56 files changed, 1746 insertions(+), 80 deletions(-)

diff --git a/cyclonedx_py/__main__.py b/cyclonedx_py/__main__.py
index 0656ab96..f65725f1 100644
--- a/cyclonedx_py/__main__.py
+++ b/cyclonedx_py/__main__.py
@@ -15,6 +15,6 @@
 
 import sys
 
-from ._internal.cli import main
+from ._internal.cli import run
 
-sys.exit(main(prog=f'python3 -m {__package__}'))
+sys.exit(run(prog=f'python3 -m {__package__}'))
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 993581df..12dd589e 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -194,7 +194,7 @@ def __call__(self,
         self.write(output, outfile)
 
 
-def main(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
+def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
     arg_co = ArgumentParser(add_help=False)
     arg_co.add_argument('-v', '--verbose',
                         help='Increase the verbosity of messages (multiple for more effect) (default: silent)',
diff --git a/cyclonedx_py/_internal/utils/bom.py b/cyclonedx_py/_internal/utils/bom.py
index 33e6945f..623f6d72 100644
--- a/cyclonedx_py/_internal/utils/bom.py
+++ b/cyclonedx_py/_internal/utils/bom.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from cyclonedx.model import Tool
+from cyclonedx.model import ExternalReference, ExternalReferenceType, Tool, XsUri
 from cyclonedx.model.bom import Bom
 
 from cyclonedx_py import __version__
@@ -24,7 +24,43 @@
 
 def make_bom() -> Bom:
     bom = Bom()
-    bom.metadata.tools.add(Tool(name='cyclonedx-bom',
-                                vendor='CycloneDX',
-                                version=__version__))
+    tool = Tool(
+        vendor='CycloneDX',
+        name='cyclonedx-bom',
+        version=__version__ or 'UNKNOWN',
+        external_references=[
+            ExternalReference(
+                type=ExternalReferenceType.BUILD_SYSTEM,
+                url=XsUri('https://github.com/CycloneDX/cyclonedx-python/actions')
+            ),
+            ExternalReference(
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri('https://pypi.org/project/cyclonedx-bom/')
+            ),
+            ExternalReference(
+                type=ExternalReferenceType.DOCUMENTATION,
+                url=XsUri('https://cyclonedx-bom-tool.readthedocs.io/')
+            ),
+            ExternalReference(
+                type=ExternalReferenceType.ISSUE_TRACKER,
+                url=XsUri('https://github.com/CycloneDX/cyclonedx-python/issues')
+            ),
+            ExternalReference(
+                type=ExternalReferenceType.LICENSE,
+                url=XsUri('https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE')
+            ),
+            ExternalReference(
+                type=ExternalReferenceType.RELEASE_NOTES,
+                url=XsUri('https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md')
+            ),
+            ExternalReference(
+                type=ExternalReferenceType.VCS,
+                url=XsUri('https://github.com/CycloneDX/cyclonedx-python')
+            ),
+            ExternalReference(
+                type=ExternalReferenceType.WEBSITE,
+                url=XsUri('https://github.com/CycloneDX/cyclonedx-python/#readme')
+            )
+        ])
+    bom.metadata.tools.add(tool)
     return bom
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index b2055e15..7ae7f44c 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -35,7 +35,7 @@ def io2file(io: BinaryIO) -> str:
     tf = NamedTemporaryFile('wt', delete=False,
                             # we prefer utf8 encoded strings, but ...
                             # - must not change newlines
-                            # - must not  change encoding, fallback to system encoding for compatibility
+                            # - must not change encoding, fallback to system encoding for compatibility
                             newline='', encoding=None)
     tf.write(io2str(io))
     tf.close()
diff --git a/poetry.lock b/poetry.lock
index a292453f..c464b943 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -194,14 +194,14 @@ toml = ["tomli"]
 
 [[package]]
 name = "cyclonedx-python-lib"
-version = "5.1.0"
+version = "5.1.1"
 description = "Python library for CycloneDX"
 category = "main"
 optional = false
 python-versions = ">=3.8,<4.0"
 files = [
-    {file = "cyclonedx_python_lib-5.1.0-py3-none-any.whl", hash = "sha256:4cf64c2e8e3e12051b56560744ad690b15670c46a15835e3d6725b8521c537bf"},
-    {file = "cyclonedx_python_lib-5.1.0.tar.gz", hash = "sha256:c315cd977c4e6052b5145f96c8eea446e49755ed337e67e55462a1a4e1de47a4"},
+    {file = "cyclonedx_python_lib-5.1.1-py3-none-any.whl", hash = "sha256:2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"},
+    {file = "cyclonedx_python_lib-5.1.1.tar.gz", hash = "sha256:215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"},
 ]
 
 [package.dependencies]
@@ -1426,4 +1426,4 @@ testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "p
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.8"
-content-hash = "6a869b3dfd89b9a131aec381d9c0b251fd786fe8ea356851df8a43698eee832d"
+content-hash = "7e410d8f751215f035bfad448ade1f2123914538be86085c166c75706e63b56d"
diff --git a/pyproject.toml b/pyproject.toml
index 30c0d60b..422eb04f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -43,7 +43,7 @@ classifiers = [
 [tool.poetry.dependencies]
 python = "^3.8"
 # ATTENTION: keep `deps.lowest.r` file in sync
-cyclonedx-python-lib = { version="^5.1.0", extras=['validation'] }
+cyclonedx-python-lib = { version="^5.1.1", extras=['validation'] }
 packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
 setuptools = ">= 47.0.0"
diff --git a/tests/__init__.py b/tests/__init__.py
index 3855b8dd..43411567 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -14,13 +14,17 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
+import re
+from json import dumps as json_dumps
 from os import getenv
 from os.path import dirname, join
 from typing import Union
 from unittest import TestCase
 
+from cyclonedx.schema import OutputFormat
+
+from cyclonedx_py import __version__ as thisVersion
+
 _TESTDATA_DIRECTORY = join(dirname(__file__), '_data')
 
 INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
@@ -58,3 +62,56 @@ def assertEqualSnapshot(self: Union[TestCase, 'SnapshotMixin'],  # noqa: N802
             self.assertEqual(actual, self.readSnapshot(snapshot_name))
         finally:
             self.maxDiff = _omd
+
+
+# region reproducible test results
+
+def make_xml_comparable(bom: str) -> str:
+    bom = re.sub(' serialNumber=".+?"', '', bom)
+    bom = re.sub(r'\s*<timestamp>.*?</timestamp>', '', bom)
+    bom = bom.replace(  # replace metadata.tools.version
+        '        <vendor>CycloneDX</vendor>\n'
+        '        <name>cyclonedx-bom</name>\n'
+        f'        <version>{thisVersion}</version>',
+        '        <vendor>CycloneDX</vendor>\n'
+        '        <name>cyclonedx-bom</name>\n'
+        '        <version>thisVersion-testing</version>')
+    bom = re.sub(  # replace metadata.tools.version
+        '        <vendor>CycloneDX</vendor>\n'
+        '        <name>cyclonedx-python-lib</name>\n'
+        '        <version>.*?</version>',
+        '        <vendor>CycloneDX</vendor>\n'
+        '        <name>cyclonedx-python-lib</name>\n'
+        '        <version>libVersion-testing</version>',
+        bom)
+    return bom
+
+
+def make_json_comparable(bom: str) -> str:
+    bom = re.sub(r'\s*"(?:timestamp|serialNumber)": ".+?",?', '', bom)
+    bom = bom.replace(  # replace metadata.tools.version
+        '        "name": "cyclonedx-bom",\n'
+        '        "vendor": "CycloneDX",\n'
+        f'        "version": {json_dumps(thisVersion)}',
+        '        "name": "cyclonedx-bom",\n'
+        '        "vendor": "CycloneDX",\n'
+        '        "version": "thisVersion-testing"')
+    bom = re.sub(  # replace metadata.tools.version
+        '        "name": "cyclonedx-python-lib",\n'
+        '        "vendor": "CycloneDX",\n'
+        '        "version": ".*?"',
+        '        "name": "cyclonedx-python-lib",\n'
+        '        "vendor": "CycloneDX",\n'
+        '        "version": "libVersion-testing"',
+        bom)
+    return bom
+
+
+def make_comparable(bom: str, of: OutputFormat) -> str:
+    if of is OutputFormat.XML:
+        return make_xml_comparable(bom)
+    if of is OutputFormat.JSON:
+        return make_json_comparable(bom)
+    raise NotImplementedError(f'unknown OutputFormat: {of!r}')
+
+# endregion reproducible test results
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
index 23fade1e..bd63a80d 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
@@ -35,7 +35,20 @@
       "ref": "requirements-L7"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
index 906ff006..1998d749 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
index 458523ca..090fcd79 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
@@ -35,7 +35,20 @@
       "ref": "requirements-L7"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
index 53cb225e..0cc5a698 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
index ab372386..7f64bc62 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
@@ -35,7 +35,88 @@
       "ref": "requirements-L7"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
index fc697731..2600777f 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
index 13692cdd..8ed5a758 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
@@ -90,7 +90,20 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
index 6912257a..5fb85d17 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L14">
       <name>foo</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
index 1403ac6f..759c0d0d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
@@ -90,7 +90,20 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
index 12ca425f..c7bd67b3 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L14">
       <name>foo</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
index fe878b89..c281e075 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
@@ -85,7 +85,88 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
index dac10331..e2f4ba4f 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L14">
       <name>foo</name>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
index b1ba5c5f..f5d6a652 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
@@ -14,7 +14,20 @@
       "ref": "requirements-L3"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
index 6d55c304..683f061f 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
       <name>mypackage</name>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
index 07107ac6..7cdf7a7b 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
@@ -14,7 +14,20 @@
       "ref": "requirements-L3"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
index bededbaa..4d3c858d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
       <name>mypackage</name>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
index d57ef197..c9db4270 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
@@ -14,7 +14,88 @@
       "ref": "requirements-L3"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
index 3f4bb011..b44ab092 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
       <name>mypackage</name>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
index 07409c15..f9bc3363 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
@@ -36,7 +36,20 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
index 39535bb7..17b32550 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
       <name>packageurl-python</name>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
index 3920a1d5..3b1ba6e0 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
@@ -36,7 +36,20 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
index 3a93100c..d0f8bd62 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
       <name>packageurl-python</name>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
index fdfe5d29..faf43154 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
@@ -33,7 +33,88 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
index 8e9399ab..b1a9b81c 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
       <name>packageurl-python</name>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
index e29f5798..d9242efa 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
@@ -58,7 +58,20 @@
       "ref": "requirements-L5"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
index 3dbd5d9b..a979ffbd 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
index 7add9eb7..d3d21335 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
@@ -58,7 +58,20 @@
       "ref": "requirements-L5"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
index 9af0eb1c..85a94338 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
index 35ad6d3a..371c0d09 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
@@ -58,7 +58,88 @@
       "ref": "requirements-L5"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
index fa80b80e..6914da3d 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
index 5c7b7a65..05e7b1e7 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
@@ -66,7 +66,20 @@
       "ref": "requirements-L7"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
index dc1d48e0..8d293dc5 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
index 3f672923..eb0a11e0 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
@@ -66,7 +66,20 @@
       "ref": "requirements-L7"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
index 80e6a2d1..c057f665 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
index 25a94d54..af89579e 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
@@ -66,7 +66,88 @@
       "ref": "requirements-L7"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
index 2f7ac2a0..cd03b415 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
       <name>FooProject</name>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
index 85204af4..abd9595a 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
@@ -121,7 +121,20 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
index 2ea24e0d..698925ee 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L10">
       <name>package-four</name>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
index 3e26e002..e628b8c8 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
@@ -121,7 +121,20 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
index a759d60c..993b81bf 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L10">
       <name>package-four</name>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
index 6df146fd..b4a63e94 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
@@ -115,7 +115,88 @@
       "ref": "requirements-L8"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
index 90987fd4..d7dbae3d 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L10">
       <name>package-four</name>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
index 41afefee..1d6ec9a1 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
@@ -36,7 +36,20 @@
       "ref": "requirements-L3"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
index 9f624533..0bec9815 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
index 24bf1e4f..75435150 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
@@ -36,7 +36,20 @@
       "ref": "requirements-L3"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
index a1bc1595..442097d1 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
@@ -1,6 +1,19 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
index e7c18286..afd6152e 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
@@ -33,7 +33,88 @@
       "ref": "requirements-L3"
     }
   ],
-  "metadata": {},
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
index 05303fc9..7db3dac2 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
@@ -1,6 +1,71 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata/>
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
       <name>certifi</name>
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 6416ccad..b3487ca8 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -21,14 +21,12 @@
 from io import StringIO
 from os.path import basename, join
 from unittest import TestCase
-from unittest.mock import patch
 
-from cyclonedx.model.bom import Bom
 from cyclonedx.schema import OutputFormat, SchemaVersion
 from ddt import ddt, named_data
 
-from cyclonedx_py._internal.cli import main
-from tests import INFILES_DIRECTORY, SnapshotMixin
+from cyclonedx_py._internal.cli import run as run_cli
+from tests import INFILES_DIRECTORY, SnapshotMixin, make_comparable
 
 infiles = glob(join(INFILES_DIRECTORY, 'requirements', '*'))
 unsupported_of_sf = [
@@ -37,14 +35,6 @@
 ]
 
 
-def make_bank_bom() -> Bom:
-    bom = Bom()
-    bom.serial_number = None
-    bom.metadata.tools.clear()
-    bom.metadata.timestamp = None
-    return bom
-
-
 @ddt
 class TestRequirements(TestCase, SnapshotMixin):
 
@@ -55,13 +45,12 @@ class TestRequirements(TestCase, SnapshotMixin):
         for of in OutputFormat
         if (of, sv) not in unsupported_of_sf
     ))
-    @patch('cyclonedx_py._internal.utils.bom.make_bom', make_bank_bom)
     def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
-            err.name = 'fakeerr'
-            out.name = 'fakeout'
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
             with redirect_stderr(err), redirect_stdout(out):
-                res = main(argv=[
+                res = run_cli(argv=[
                     'requirements',
                     '-vvv',
                     f'--sv={sv.to_version()}',
@@ -72,7 +61,7 @@ def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat)
             out = out.getvalue()
         self.assertEqual(0, res, err)
         self.assertEqualSnapshot(
-            out,
+            make_comparable(out, of),
             f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}')
 
     def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:

From 7d7a8f3c71590901346d270f4b8ac75fbfb8b506 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 12:26:05 +0100
Subject: [PATCH 042/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/python.yml       | 35 ++++++++++++++++++++++++++++++
 cyclonedx_py/_internal/utils/io.py | 12 +++++-----
 pyproject.toml                     |  2 +-
 3 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index b37bcfc2..19b22dd4 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -122,6 +122,41 @@ jobs:
       - name: Run tox
         run: poetry run tox run -e bandit -s false
 
+  install-and-run:
+    name: install & run "${{matrix.command}}" (${{matrix.os}} py${{matrox.python-version}})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        command:
+          - cyclonedx-py --help
+          - python -m cyclonedx_py --help
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+        python-version:
+          - "3.11"
+    steps:
+      - name: Checkout
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@v4
+      - name: Setup Python Environment
+        # see https://github.com/actions/setup-python
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ matrix.python-version }}
+          architecture: 'x64'
+      - name: Install poetry
+        # see https://github.com/marketplace/actions/setup-poetry
+        uses: Gr1N/setup-poetry@v8
+        with:
+          poetry-version: ${{ env.POETRY_VERSION }}
+      - name: Install dependencies
+        run: poetry install --no-dev
+      - name: run command
+        run: poetry run ${{matrix.command}}
   build-and-test:
     name: Test (${{ matrix.os }} py${{ matrix.python-version }} ${{ matrix.toxenv-factor }})
     runs-on: ${{ matrix.os }}
diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index 7ae7f44c..0b77525d 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -15,28 +15,28 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
-
+from sys import getdefaultencoding
 from tempfile import NamedTemporaryFile
 from typing import BinaryIO
 
 from chardet import detect as chardetect
 
 
-def io2str(io: BinaryIO) -> str:
+def io2str(io: BinaryIO, *, errors: str = 'strict') -> str:
     data = io.read()
-    encoding = (chardetect(data)['encoding'] or '').replace(
+    encoding = (chardetect(data)['encoding'] or getdefaultencoding()).replace(
         # replace Windows-encoding with code-page
         'Windows-', 'cp')
-    return data.decode(encoding)
+    return data.decode(encoding, errors)
 
 
-def io2file(io: BinaryIO) -> str:
+def io2file(io: BinaryIO, *, errors: str = 'strict') -> str:
     # prevent issues on windows: https://github.com/python/cpython/issues/58451
     tf = NamedTemporaryFile('wt', delete=False,
                             # we prefer utf8 encoded strings, but ...
                             # - must not change newlines
                             # - must not change encoding, fallback to system encoding for compatibility
                             newline='', encoding=None)
-    tf.write(io2str(io))
+    tf.write(io2str(io, errors=errors))
     tf.close()
     return tf.name
diff --git a/pyproject.toml b/pyproject.toml
index 422eb04f..48dc2550 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -69,7 +69,7 @@ types-toml = "^0.10.0"
 types-setuptools = ">= 57.0.0"
 
 [tool.poetry.scripts]
-cyclonedx-py  = 'cyclonedx_py._internal.cli:main'
+cyclonedx-py  = 'cyclonedx_py._internal.cli:run'
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]

From 3aedf7365ee3dc54c67418615d8c719c39bc44dc Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 12:34:26 +0100
Subject: [PATCH 043/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/python.yml |    7 +-
 .gitignore                   |  176 ++++-
 poetry.lock                  | 1429 ----------------------------------
 pyproject.toml               |    1 +
 4 files changed, 165 insertions(+), 1448 deletions(-)
 delete mode 100644 poetry.lock

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 19b22dd4..a6970744 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -71,7 +71,7 @@ jobs:
       matrix:
         include:
           - # test with the locked dependencies
-            python-version: '3.11'
+            python-version: '3.12'
             toxenv-factor: 'locked'
             os: ubuntu-latest
           - # test with the lowest dependencies
@@ -136,8 +136,6 @@ jobs:
           - ubuntu-latest
           - macos-latest
           - windows-latest
-        python-version:
-          - "3.11"
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
@@ -169,7 +167,8 @@ jobs:
           - macos-latest
           - windows-latest
         python-version:
-          - "3.11" # highest supported
+          - "3.12" # highest supported
+          - "3.11"
           - "3.10"
           - "3.9"
           - "3.8"  # lowest supported -- handled in include
diff --git a/.gitignore b/.gitignore
index 1f87e87c..f4ec3eda 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,25 +1,171 @@
-# Exlude python build & distribution directories
+
+test-reports
+
+# Exlude IDE related files
+.idea/
+.vscode/
+
+
+
+### source: https://github.com/github/gitignore/blob/main/Python.gitignore
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
 build/
+develop-eggs/
 dist/
-*.egg-info*
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
 
-# Exlude *.pyc
-*.pyc
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
 
-# Exclude test-related items
-.tox/*
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
 
-# Exclude coverage
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
 .coverage
-test-reports
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
 
-# Exclude Python Virtual Environment
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+.python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+Pipfile.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+pdm.lock
+#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
+#   in version control.
+#   https://pdm.fming.dev/#use-with-ide
+.pdm.toml
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
 venv/
-.venv/
+ENV/
+env.bak/
+venv.bak/
 
-# Exlude IDE related files
-.idea/*
-.vscode/*
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
 
-# Exclude generated docs
-docs/_build
\ No newline at end of file
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
diff --git a/poetry.lock b/poetry.lock
deleted file mode 100644
index c464b943..00000000
--- a/poetry.lock
+++ /dev/null
@@ -1,1429 +0,0 @@
-# This file is automatically @generated by Poetry 1.4.1 and should not be changed by hand.
-
-[[package]]
-name = "arrow"
-version = "1.3.0"
-description = "Better dates & times for Python"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
-    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
-]
-
-[package.dependencies]
-python-dateutil = ">=2.7.0"
-types-python-dateutil = ">=2.8.10"
-
-[package.extras]
-doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
-test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
-
-[[package]]
-name = "attrs"
-version = "23.1.0"
-description = "Classes Without Boilerplate"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"},
-    {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"},
-]
-
-[package.extras]
-cov = ["attrs[tests]", "coverage[toml] (>=5.3)"]
-dev = ["attrs[docs,tests]", "pre-commit"]
-docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"]
-tests = ["attrs[tests-no-zope]", "zope-interface"]
-tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
-
-[[package]]
-name = "autopep8"
-version = "2.0.4"
-description = "A tool that automatically formats Python code to conform to the PEP 8 style guide"
-category = "dev"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "autopep8-2.0.4-py2.py3-none-any.whl", hash = "sha256:067959ca4a07b24dbd5345efa8325f5f58da4298dab0dde0443d5ed765de80cb"},
-    {file = "autopep8-2.0.4.tar.gz", hash = "sha256:2913064abd97b3419d1cc83ea71f042cb821f87e45b9c88cad5ad3c4ea87fe0c"},
-]
-
-[package.dependencies]
-pycodestyle = ">=2.10.0"
-tomli = {version = "*", markers = "python_version < \"3.11\""}
-
-[[package]]
-name = "bandit"
-version = "1.7.5"
-description = "Security oriented static analyser for python code."
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "bandit-1.7.5-py3-none-any.whl", hash = "sha256:75665181dc1e0096369112541a056c59d1c5f66f9bb74a8d686c3c362b83f549"},
-    {file = "bandit-1.7.5.tar.gz", hash = "sha256:bdfc739baa03b880c2d15d0431b31c658ffc348e907fe197e54e0389dd59e11e"},
-]
-
-[package.dependencies]
-colorama = {version = ">=0.3.9", markers = "platform_system == \"Windows\""}
-GitPython = ">=1.0.1"
-PyYAML = ">=5.3.1"
-rich = "*"
-stevedore = ">=1.20.0"
-
-[package.extras]
-test = ["beautifulsoup4 (>=4.8.0)", "coverage (>=4.5.4)", "fixtures (>=3.0.0)", "flake8 (>=4.0.0)", "pylint (==1.9.4)", "stestr (>=2.5.0)", "testscenarios (>=0.5.0)", "testtools (>=2.3.0)", "tomli (>=1.1.0)"]
-toml = ["tomli (>=1.1.0)"]
-yaml = ["PyYAML"]
-
-[[package]]
-name = "boolean-py"
-version = "4.0"
-description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "boolean.py-4.0-py3-none-any.whl", hash = "sha256:2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"},
-    {file = "boolean.py-4.0.tar.gz", hash = "sha256:17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"},
-]
-
-[[package]]
-name = "cachetools"
-version = "5.3.2"
-description = "Extensible memoizing collections and decorators"
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "cachetools-5.3.2-py3-none-any.whl", hash = "sha256:861f35a13a451f94e301ce2bec7cac63e881232ccce7ed67fab9b5df4d3beaa1"},
-    {file = "cachetools-5.3.2.tar.gz", hash = "sha256:086ee420196f7b2ab9ca2db2520aca326318b68fe5ba8bc4d49cca91add450f2"},
-]
-
-[[package]]
-name = "chardet"
-version = "5.2.0"
-description = "Universal encoding detector for Python 3"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "chardet-5.2.0-py3-none-any.whl", hash = "sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970"},
-    {file = "chardet-5.2.0.tar.gz", hash = "sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7"},
-]
-
-[[package]]
-name = "colorama"
-version = "0.4.6"
-description = "Cross-platform colored terminal text."
-category = "dev"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
-files = [
-    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
-    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
-]
-
-[[package]]
-name = "coverage"
-version = "7.3.1"
-description = "Code coverage measurement for Python"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "coverage-7.3.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:cd0f7429ecfd1ff597389907045ff209c8fdb5b013d38cfa7c60728cb484b6e3"},
-    {file = "coverage-7.3.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:966f10df9b2b2115da87f50f6a248e313c72a668248be1b9060ce935c871f276"},
-    {file = "coverage-7.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0575c37e207bb9b98b6cf72fdaaa18ac909fb3d153083400c2d48e2e6d28bd8e"},
-    {file = "coverage-7.3.1-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:245c5a99254e83875c7fed8b8b2536f040997a9b76ac4c1da5bff398c06e860f"},
-    {file = "coverage-7.3.1-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4c96dd7798d83b960afc6c1feb9e5af537fc4908852ef025600374ff1a017392"},
-    {file = "coverage-7.3.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:de30c1aa80f30af0f6b2058a91505ea6e36d6535d437520067f525f7df123887"},
-    {file = "coverage-7.3.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:50dd1e2dd13dbbd856ffef69196781edff26c800a74f070d3b3e3389cab2600d"},
-    {file = "coverage-7.3.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:b9c0c19f70d30219113b18fe07e372b244fb2a773d4afde29d5a2f7930765136"},
-    {file = "coverage-7.3.1-cp310-cp310-win32.whl", hash = "sha256:770f143980cc16eb601ccfd571846e89a5fe4c03b4193f2e485268f224ab602f"},
-    {file = "coverage-7.3.1-cp310-cp310-win_amd64.whl", hash = "sha256:cdd088c00c39a27cfa5329349cc763a48761fdc785879220d54eb785c8a38520"},
-    {file = "coverage-7.3.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:74bb470399dc1989b535cb41f5ca7ab2af561e40def22d7e188e0a445e7639e3"},
-    {file = "coverage-7.3.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:025ded371f1ca280c035d91b43252adbb04d2aea4c7105252d3cbc227f03b375"},
-    {file = "coverage-7.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a6191b3a6ad3e09b6cfd75b45c6aeeffe7e3b0ad46b268345d159b8df8d835f9"},
-    {file = "coverage-7.3.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7eb0b188f30e41ddd659a529e385470aa6782f3b412f860ce22b2491c89b8593"},
-    {file = "coverage-7.3.1-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:75c8f0df9dfd8ff745bccff75867d63ef336e57cc22b2908ee725cc552689ec8"},
-    {file = "coverage-7.3.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:7eb3cd48d54b9bd0e73026dedce44773214064be93611deab0b6a43158c3d5a0"},
-    {file = "coverage-7.3.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:ac3c5b7e75acac31e490b7851595212ed951889918d398b7afa12736c85e13ce"},
-    {file = "coverage-7.3.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:5b4ee7080878077af0afa7238df1b967f00dc10763f6e1b66f5cced4abebb0a3"},
-    {file = "coverage-7.3.1-cp311-cp311-win32.whl", hash = "sha256:229c0dd2ccf956bf5aeede7e3131ca48b65beacde2029f0361b54bf93d36f45a"},
-    {file = "coverage-7.3.1-cp311-cp311-win_amd64.whl", hash = "sha256:c6f55d38818ca9596dc9019eae19a47410d5322408140d9a0076001a3dcb938c"},
-    {file = "coverage-7.3.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:5289490dd1c3bb86de4730a92261ae66ea8d44b79ed3cc26464f4c2cde581fbc"},
-    {file = "coverage-7.3.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ca833941ec701fda15414be400c3259479bfde7ae6d806b69e63b3dc423b1832"},
-    {file = "coverage-7.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cd694e19c031733e446c8024dedd12a00cda87e1c10bd7b8539a87963685e969"},
-    {file = "coverage-7.3.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:aab8e9464c00da5cb9c536150b7fbcd8850d376d1151741dd0d16dfe1ba4fd26"},
-    {file = "coverage-7.3.1-cp312-cp312-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:87d38444efffd5b056fcc026c1e8d862191881143c3aa80bb11fcf9dca9ae204"},
-    {file = "coverage-7.3.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:8a07b692129b8a14ad7a37941a3029c291254feb7a4237f245cfae2de78de037"},
-    {file = "coverage-7.3.1-cp312-cp312-musllinux_1_1_i686.whl", hash = "sha256:2829c65c8faaf55b868ed7af3c7477b76b1c6ebeee99a28f59a2cb5907a45760"},
-    {file = "coverage-7.3.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:1f111a7d85658ea52ffad7084088277135ec5f368457275fc57f11cebb15607f"},
-    {file = "coverage-7.3.1-cp312-cp312-win32.whl", hash = "sha256:c397c70cd20f6df7d2a52283857af622d5f23300c4ca8e5bd8c7a543825baa5a"},
-    {file = "coverage-7.3.1-cp312-cp312-win_amd64.whl", hash = "sha256:5ae4c6da8b3d123500f9525b50bf0168023313963e0e2e814badf9000dd6ef92"},
-    {file = "coverage-7.3.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:ca70466ca3a17460e8fc9cea7123c8cbef5ada4be3140a1ef8f7b63f2f37108f"},
-    {file = "coverage-7.3.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:f2781fd3cabc28278dc982a352f50c81c09a1a500cc2086dc4249853ea96b981"},
-    {file = "coverage-7.3.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6407424621f40205bbe6325686417e5e552f6b2dba3535dd1f90afc88a61d465"},
-    {file = "coverage-7.3.1-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:04312b036580ec505f2b77cbbdfb15137d5efdfade09156961f5277149f5e344"},
-    {file = "coverage-7.3.1-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ac9ad38204887349853d7c313f53a7b1c210ce138c73859e925bc4e5d8fc18e7"},
-    {file = "coverage-7.3.1-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:53669b79f3d599da95a0afbef039ac0fadbb236532feb042c534fbb81b1a4e40"},
-    {file = "coverage-7.3.1-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:614f1f98b84eb256e4f35e726bfe5ca82349f8dfa576faabf8a49ca09e630086"},
-    {file = "coverage-7.3.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:f1a317fdf5c122ad642db8a97964733ab7c3cf6009e1a8ae8821089993f175ff"},
-    {file = "coverage-7.3.1-cp38-cp38-win32.whl", hash = "sha256:defbbb51121189722420a208957e26e49809feafca6afeef325df66c39c4fdb3"},
-    {file = "coverage-7.3.1-cp38-cp38-win_amd64.whl", hash = "sha256:f4f456590eefb6e1b3c9ea6328c1e9fa0f1006e7481179d749b3376fc793478e"},
-    {file = "coverage-7.3.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:f12d8b11a54f32688b165fd1a788c408f927b0960984b899be7e4c190ae758f1"},
-    {file = "coverage-7.3.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:f09195dda68d94a53123883de75bb97b0e35f5f6f9f3aa5bf6e496da718f0cb6"},
-    {file = "coverage-7.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c6601a60318f9c3945be6ea0f2a80571f4299b6801716f8a6e4846892737ebe4"},
-    {file = "coverage-7.3.1-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:07d156269718670d00a3b06db2288b48527fc5f36859425ff7cec07c6b367745"},
-    {file = "coverage-7.3.1-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:636a8ac0b044cfeccae76a36f3b18264edcc810a76a49884b96dd744613ec0b7"},
-    {file = "coverage-7.3.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:5d991e13ad2ed3aced177f524e4d670f304c8233edad3210e02c465351f785a0"},
-    {file = "coverage-7.3.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:586649ada7cf139445da386ab6f8ef00e6172f11a939fc3b2b7e7c9082052fa0"},
-    {file = "coverage-7.3.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:4aba512a15a3e1e4fdbfed2f5392ec221434a614cc68100ca99dcad7af29f3f8"},
-    {file = "coverage-7.3.1-cp39-cp39-win32.whl", hash = "sha256:6bc6f3f4692d806831c136c5acad5ccedd0262aa44c087c46b7101c77e139140"},
-    {file = "coverage-7.3.1-cp39-cp39-win_amd64.whl", hash = "sha256:553d7094cb27db58ea91332e8b5681bac107e7242c23f7629ab1316ee73c4981"},
-    {file = "coverage-7.3.1-pp38.pp39.pp310-none-any.whl", hash = "sha256:220eb51f5fb38dfdb7e5d54284ca4d0cd70ddac047d750111a68ab1798945194"},
-    {file = "coverage-7.3.1.tar.gz", hash = "sha256:6cb7fe1581deb67b782c153136541e20901aa312ceedaf1467dcb35255787952"},
-]
-
-[package.extras]
-toml = ["tomli"]
-
-[[package]]
-name = "cyclonedx-python-lib"
-version = "5.1.1"
-description = "Python library for CycloneDX"
-category = "main"
-optional = false
-python-versions = ">=3.8,<4.0"
-files = [
-    {file = "cyclonedx_python_lib-5.1.1-py3-none-any.whl", hash = "sha256:2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"},
-    {file = "cyclonedx_python_lib-5.1.1.tar.gz", hash = "sha256:215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"},
-]
-
-[package.dependencies]
-jsonschema = {version = ">=4.18,<5.0", extras = ["format"], optional = true, markers = "extra == \"validation\" or extra == \"json-validation\""}
-license-expression = ">=30,<31"
-lxml = {version = ">=4,<5", optional = true, markers = "extra == \"validation\" or extra == \"xml-validation\""}
-packageurl-python = ">=0.11"
-py-serializable = ">=0.15,<0.16"
-sortedcontainers = ">=2.4.0,<3.0.0"
-
-[package.extras]
-json-validation = ["jsonschema[format] (>=4.18,<5.0)"]
-validation = ["jsonschema[format] (>=4.18,<5.0)", "lxml (>=4,<5)"]
-xml-validation = ["lxml (>=4,<5)"]
-
-[[package]]
-name = "ddt"
-version = "1.6.0"
-description = "Data-Driven/Decorated Tests"
-category = "dev"
-optional = false
-python-versions = "*"
-files = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-
-[[package]]
-name = "defusedxml"
-version = "0.7.1"
-description = "XML bomb protection for Python stdlib modules"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-files = [
-    {file = "defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"},
-    {file = "defusedxml-0.7.1.tar.gz", hash = "sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"},
-]
-
-[[package]]
-name = "distlib"
-version = "0.3.7"
-description = "Distribution utilities"
-category = "dev"
-optional = false
-python-versions = "*"
-files = [
-    {file = "distlib-0.3.7-py2.py3-none-any.whl", hash = "sha256:2e24928bc811348f0feb63014e97aaae3037f2cf48712d51ae61df7fd6075057"},
-    {file = "distlib-0.3.7.tar.gz", hash = "sha256:9dafe54b34a028eafd95039d5e5d4851a13734540f1331060d31c9916e7147a8"},
-]
-
-[[package]]
-name = "filelock"
-version = "3.13.1"
-description = "A platform independent file lock."
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "filelock-3.13.1-py3-none-any.whl", hash = "sha256:57dbda9b35157b05fb3e58ee91448612eb674172fab98ee235ccb0b5bee19a1c"},
-    {file = "filelock-3.13.1.tar.gz", hash = "sha256:521f5f56c50f8426f5e03ad3b281b490a87ef15bc6c526f168290f0c7148d44e"},
-]
-
-[package.extras]
-docs = ["furo (>=2023.9.10)", "sphinx (>=7.2.6)", "sphinx-autodoc-typehints (>=1.24)"]
-testing = ["covdefaults (>=2.3)", "coverage (>=7.3.2)", "diff-cover (>=8)", "pytest (>=7.4.3)", "pytest-cov (>=4.1)", "pytest-mock (>=3.12)", "pytest-timeout (>=2.2)"]
-typing = ["typing-extensions (>=4.8)"]
-
-[[package]]
-name = "flake8"
-version = "6.1.0"
-description = "the modular source code checker: pep8 pyflakes and co"
-category = "dev"
-optional = false
-python-versions = ">=3.8.1"
-files = [
-    {file = "flake8-6.1.0-py2.py3-none-any.whl", hash = "sha256:ffdfce58ea94c6580c77888a86506937f9a1a227dfcd15f245d694ae20a6b6e5"},
-    {file = "flake8-6.1.0.tar.gz", hash = "sha256:d5b3857f07c030bdb5bf41c7f53799571d75c4491748a3adcd47de929e34cd23"},
-]
-
-[package.dependencies]
-mccabe = ">=0.7.0,<0.8.0"
-pycodestyle = ">=2.11.0,<2.12.0"
-pyflakes = ">=3.1.0,<3.2.0"
-
-[[package]]
-name = "flake8-annotations"
-version = "3.0.1"
-description = "Flake8 Type Annotation Checks"
-category = "dev"
-optional = false
-python-versions = ">=3.8.1"
-files = [
-    {file = "flake8_annotations-3.0.1-py3-none-any.whl", hash = "sha256:af78e3216ad800d7e144745ece6df706c81b3255290cbf870e54879d495e8ade"},
-    {file = "flake8_annotations-3.0.1.tar.gz", hash = "sha256:ff37375e71e3b83f2a5a04d443c41e2c407de557a884f3300a7fa32f3c41cb0a"},
-]
-
-[package.dependencies]
-attrs = ">=21.4"
-flake8 = ">=5.0"
-
-[[package]]
-name = "flake8-bugbear"
-version = "23.7.10"
-description = "A plugin for flake8 finding likely bugs and design problems in your program. Contains warnings that don't belong in pyflakes and pycodestyle."
-category = "dev"
-optional = false
-python-versions = ">=3.8.1"
-files = [
-    {file = "flake8-bugbear-23.7.10.tar.gz", hash = "sha256:0ebdc7d8ec1ca8bd49347694562381f099f4de2f8ec6bda7a7dca65555d9e0d4"},
-    {file = "flake8_bugbear-23.7.10-py3-none-any.whl", hash = "sha256:d99d005114020fbef47ed5e4aebafd22f167f9a0fbd0d8bf3c9e90612cb25c34"},
-]
-
-[package.dependencies]
-attrs = ">=19.2.0"
-flake8 = ">=6.0.0"
-
-[package.extras]
-dev = ["coverage", "hypothesis", "hypothesmith (>=0.2)", "pre-commit", "pytest", "tox"]
-
-[[package]]
-name = "flake8-isort"
-version = "6.0.0"
-description = "flake8 plugin that integrates isort ."
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "flake8-isort-6.0.0.tar.gz", hash = "sha256:537f453a660d7e903f602ecfa36136b140de279df58d02eb1b6a0c84e83c528c"},
-    {file = "flake8_isort-6.0.0-py3-none-any.whl", hash = "sha256:aa0cac02a62c7739e370ce6b9c31743edac904bae4b157274511fc8a19c75bbc"},
-]
-
-[package.dependencies]
-flake8 = "*"
-isort = ">=5.0.0,<6"
-
-[package.extras]
-test = ["pytest"]
-
-[[package]]
-name = "fqdn"
-version = "1.5.1"
-description = "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0, !=3.1, !=3.2, !=3.3, !=3.4, <4"
-files = [
-    {file = "fqdn-1.5.1-py3-none-any.whl", hash = "sha256:3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"},
-    {file = "fqdn-1.5.1.tar.gz", hash = "sha256:105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"},
-]
-
-[[package]]
-name = "gitdb"
-version = "4.0.11"
-description = "Git Object Database"
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "gitdb-4.0.11-py3-none-any.whl", hash = "sha256:81a3407ddd2ee8df444cbacea00e2d038e40150acfa3001696fe0dcf1d3adfa4"},
-    {file = "gitdb-4.0.11.tar.gz", hash = "sha256:bf5421126136d6d0af55bc1e7c1af1c397a34f5b7bd79e776cd3e89785c2b04b"},
-]
-
-[package.dependencies]
-smmap = ">=3.0.1,<6"
-
-[[package]]
-name = "gitpython"
-version = "3.1.40"
-description = "GitPython is a Python library used to interact with Git repositories"
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "GitPython-3.1.40-py3-none-any.whl", hash = "sha256:cf14627d5a8049ffbf49915732e5eddbe8134c3bdb9d476e6182b676fc573f8a"},
-    {file = "GitPython-3.1.40.tar.gz", hash = "sha256:22b126e9ffb671fdd0c129796343a02bf67bf2994b35449ffc9321aa755e18a4"},
-]
-
-[package.dependencies]
-gitdb = ">=4.0.1,<5"
-
-[package.extras]
-test = ["black", "coverage[toml]", "ddt (>=1.1.1,!=1.4.3)", "mock", "mypy", "pre-commit", "pytest", "pytest-cov", "pytest-instafail", "pytest-subtests", "pytest-sugar"]
-
-[[package]]
-name = "idna"
-version = "3.4"
-description = "Internationalized Domain Names in Applications (IDNA)"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
-    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
-]
-
-[[package]]
-name = "importlib-resources"
-version = "6.1.0"
-description = "Read resources from Python packages"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "importlib_resources-6.1.0-py3-none-any.whl", hash = "sha256:aa50258bbfa56d4e33fbd8aa3ef48ded10d1735f11532b8df95388cc6bdb7e83"},
-    {file = "importlib_resources-6.1.0.tar.gz", hash = "sha256:9d48dcccc213325e810fd723e7fbb45ccb39f6cf5c31f00cf2b965f5f10f3cb9"},
-]
-
-[package.dependencies]
-zipp = {version = ">=3.1.0", markers = "python_version < \"3.10\""}
-
-[package.extras]
-docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
-testing = ["pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-mypy (>=0.9.1)", "pytest-ruff", "zipp (>=3.17)"]
-
-[[package]]
-name = "isoduration"
-version = "20.11.0"
-description = "Operations with ISO 8601 durations"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
-    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
-]
-
-[package.dependencies]
-arrow = ">=0.15.0"
-
-[[package]]
-name = "isort"
-version = "5.12.0"
-description = "A Python utility / library to sort Python imports."
-category = "dev"
-optional = false
-python-versions = ">=3.8.0"
-files = [
-    {file = "isort-5.12.0-py3-none-any.whl", hash = "sha256:f84c2818376e66cf843d497486ea8fed8700b340f308f076c6fb1229dff318b6"},
-    {file = "isort-5.12.0.tar.gz", hash = "sha256:8bef7dde241278824a6d83f44a544709b065191b95b6e50894bdc722fcba0504"},
-]
-
-[package.extras]
-colors = ["colorama (>=0.4.3)"]
-pipfile-deprecated-finder = ["pip-shims (>=0.5.2)", "pipreqs", "requirementslib"]
-plugins = ["setuptools"]
-requirements-deprecated-finder = ["pip-api", "pipreqs"]
-
-[[package]]
-name = "jsonpointer"
-version = "2.4"
-description = "Identify specific nodes in a JSON document (RFC 6901)"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*, !=3.6.*"
-files = [
-    {file = "jsonpointer-2.4-py2.py3-none-any.whl", hash = "sha256:15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"},
-    {file = "jsonpointer-2.4.tar.gz", hash = "sha256:585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"},
-]
-
-[[package]]
-name = "jsonschema"
-version = "4.19.2"
-description = "An implementation of JSON Schema validation for Python"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "jsonschema-4.19.2-py3-none-any.whl", hash = "sha256:eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"},
-    {file = "jsonschema-4.19.2.tar.gz", hash = "sha256:c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"},
-]
-
-[package.dependencies]
-attrs = ">=22.2.0"
-fqdn = {version = "*", optional = true, markers = "extra == \"format\""}
-idna = {version = "*", optional = true, markers = "extra == \"format\""}
-importlib-resources = {version = ">=1.4.0", markers = "python_version < \"3.9\""}
-isoduration = {version = "*", optional = true, markers = "extra == \"format\""}
-jsonpointer = {version = ">1.13", optional = true, markers = "extra == \"format\""}
-jsonschema-specifications = ">=2023.03.6"
-pkgutil-resolve-name = {version = ">=1.3.10", markers = "python_version < \"3.9\""}
-referencing = ">=0.28.4"
-rfc3339-validator = {version = "*", optional = true, markers = "extra == \"format\""}
-rfc3987 = {version = "*", optional = true, markers = "extra == \"format\""}
-rpds-py = ">=0.7.1"
-uri-template = {version = "*", optional = true, markers = "extra == \"format\""}
-webcolors = {version = ">=1.11", optional = true, markers = "extra == \"format\""}
-
-[package.extras]
-format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
-format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3986-validator (>0.1.0)", "uri-template", "webcolors (>=1.11)"]
-
-[[package]]
-name = "jsonschema-specifications"
-version = "2023.7.1"
-description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "jsonschema_specifications-2023.7.1-py3-none-any.whl", hash = "sha256:05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"},
-    {file = "jsonschema_specifications-2023.7.1.tar.gz", hash = "sha256:c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"},
-]
-
-[package.dependencies]
-importlib-resources = {version = ">=1.4.0", markers = "python_version < \"3.9\""}
-referencing = ">=0.28.0"
-
-[[package]]
-name = "license-expression"
-version = "30.1.1"
-description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "license-expression-30.1.1.tar.gz", hash = "sha256:42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"},
-    {file = "license_expression-30.1.1-py3-none-any.whl", hash = "sha256:8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"},
-]
-
-[package.dependencies]
-"boolean.py" = ">=4.0"
-
-[package.extras]
-docs = ["Sphinx (==5.1.0)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)"]
-testing = ["black", "isort", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)", "twine"]
-
-[[package]]
-name = "lxml"
-version = "4.9.3"
-description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
-files = [
-    {file = "lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl", hash = "sha256:b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"},
-    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"},
-    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"},
-    {file = "lxml-4.9.3-cp27-cp27m-win32.whl", hash = "sha256:2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"},
-    {file = "lxml-4.9.3-cp27-cp27m-win_amd64.whl", hash = "sha256:4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"},
-    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"},
-    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"},
-    {file = "lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"},
-    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"},
-    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"},
-    {file = "lxml-4.9.3-cp310-cp310-win32.whl", hash = "sha256:cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"},
-    {file = "lxml-4.9.3-cp310-cp310-win_amd64.whl", hash = "sha256:97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"},
-    {file = "lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"},
-    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"},
-    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"},
-    {file = "lxml-4.9.3-cp311-cp311-win32.whl", hash = "sha256:0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"},
-    {file = "lxml-4.9.3-cp311-cp311-win_amd64.whl", hash = "sha256:25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"},
-    {file = "lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"},
-    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"},
-    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"},
-    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"},
-    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"},
-    {file = "lxml-4.9.3-cp312-cp312-win_amd64.whl", hash = "sha256:d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"},
-    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"},
-    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"},
-    {file = "lxml-4.9.3-cp35-cp35m-win32.whl", hash = "sha256:704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"},
-    {file = "lxml-4.9.3-cp35-cp35m-win_amd64.whl", hash = "sha256:c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"},
-    {file = "lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl", hash = "sha256:64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl", hash = "sha256:4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"},
-    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl", hash = "sha256:0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"},
-    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl", hash = "sha256:aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"},
-    {file = "lxml-4.9.3-cp36-cp36m-win32.whl", hash = "sha256:50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"},
-    {file = "lxml-4.9.3-cp36-cp36m-win_amd64.whl", hash = "sha256:bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl", hash = "sha256:53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"},
-    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"},
-    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"},
-    {file = "lxml-4.9.3-cp37-cp37m-win32.whl", hash = "sha256:1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"},
-    {file = "lxml-4.9.3-cp37-cp37m-win_amd64.whl", hash = "sha256:120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl", hash = "sha256:6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"},
-    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"},
-    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"},
-    {file = "lxml-4.9.3-cp38-cp38-win32.whl", hash = "sha256:57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"},
-    {file = "lxml-4.9.3-cp38-cp38-win_amd64.whl", hash = "sha256:92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"},
-    {file = "lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl", hash = "sha256:9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl", hash = "sha256:303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl", hash = "sha256:5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"},
-    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"},
-    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"},
-    {file = "lxml-4.9.3-cp39-cp39-win32.whl", hash = "sha256:8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"},
-    {file = "lxml-4.9.3-cp39-cp39-win_amd64.whl", hash = "sha256:4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"},
-    {file = "lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"},
-    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"},
-    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"},
-    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl", hash = "sha256:5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl", hash = "sha256:ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"},
-    {file = "lxml-4.9.3.tar.gz", hash = "sha256:48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"},
-]
-
-[package.extras]
-cssselect = ["cssselect (>=0.7)"]
-html5 = ["html5lib"]
-htmlsoup = ["BeautifulSoup4"]
-source = ["Cython (>=0.29.35)"]
-
-[[package]]
-name = "markdown-it-py"
-version = "3.0.0"
-description = "Python port of markdown-it. Markdown parsing, done right!"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "markdown-it-py-3.0.0.tar.gz", hash = "sha256:e3f60a94fa066dc52ec76661e37c851cb232d92f9886b15cb560aaada2df8feb"},
-    {file = "markdown_it_py-3.0.0-py3-none-any.whl", hash = "sha256:355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1"},
-]
-
-[package.dependencies]
-mdurl = ">=0.1,<1.0"
-
-[package.extras]
-benchmarking = ["psutil", "pytest", "pytest-benchmark"]
-code-style = ["pre-commit (>=3.0,<4.0)"]
-compare = ["commonmark (>=0.9,<1.0)", "markdown (>=3.4,<4.0)", "mistletoe (>=1.0,<2.0)", "mistune (>=2.0,<3.0)", "panflute (>=2.3,<3.0)"]
-linkify = ["linkify-it-py (>=1,<3)"]
-plugins = ["mdit-py-plugins"]
-profiling = ["gprof2dot"]
-rtd = ["jupyter_sphinx", "mdit-py-plugins", "myst-parser", "pyyaml", "sphinx", "sphinx-copybutton", "sphinx-design", "sphinx_book_theme"]
-testing = ["coverage", "pytest", "pytest-cov", "pytest-regressions"]
-
-[[package]]
-name = "mccabe"
-version = "0.7.0"
-description = "McCabe checker, plugin for flake8"
-category = "dev"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "mccabe-0.7.0-py2.py3-none-any.whl", hash = "sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e"},
-    {file = "mccabe-0.7.0.tar.gz", hash = "sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325"},
-]
-
-[[package]]
-name = "mdurl"
-version = "0.1.2"
-description = "Markdown URL utilities"
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "mdurl-0.1.2-py3-none-any.whl", hash = "sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8"},
-    {file = "mdurl-0.1.2.tar.gz", hash = "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba"},
-]
-
-[[package]]
-name = "mypy"
-version = "1.6.1"
-description = "Optional static typing for Python"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "mypy-1.6.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e5012e5cc2ac628177eaac0e83d622b2dd499e28253d4107a08ecc59ede3fc2c"},
-    {file = "mypy-1.6.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:d8fbb68711905f8912e5af474ca8b78d077447d8f3918997fecbf26943ff3cbb"},
-    {file = "mypy-1.6.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:21a1ad938fee7d2d96ca666c77b7c494c3c5bd88dff792220e1afbebb2925b5e"},
-    {file = "mypy-1.6.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:b96ae2c1279d1065413965c607712006205a9ac541895004a1e0d4f281f2ff9f"},
-    {file = "mypy-1.6.1-cp310-cp310-win_amd64.whl", hash = "sha256:40b1844d2e8b232ed92e50a4bd11c48d2daa351f9deee6c194b83bf03e418b0c"},
-    {file = "mypy-1.6.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:81af8adaa5e3099469e7623436881eff6b3b06db5ef75e6f5b6d4871263547e5"},
-    {file = "mypy-1.6.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:8c223fa57cb154c7eab5156856c231c3f5eace1e0bed9b32a24696b7ba3c3245"},
-    {file = "mypy-1.6.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a8032e00ce71c3ceb93eeba63963b864bf635a18f6c0c12da6c13c450eedb183"},
-    {file = "mypy-1.6.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:4c46b51de523817a0045b150ed11b56f9fff55f12b9edd0f3ed35b15a2809de0"},
-    {file = "mypy-1.6.1-cp311-cp311-win_amd64.whl", hash = "sha256:19f905bcfd9e167159b3d63ecd8cb5e696151c3e59a1742e79bc3bcb540c42c7"},
-    {file = "mypy-1.6.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:82e469518d3e9a321912955cc702d418773a2fd1e91c651280a1bda10622f02f"},
-    {file = "mypy-1.6.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d4473c22cc296425bbbce7e9429588e76e05bc7342da359d6520b6427bf76660"},
-    {file = "mypy-1.6.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:59a0d7d24dfb26729e0a068639a6ce3500e31d6655df8557156c51c1cb874ce7"},
-    {file = "mypy-1.6.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:cfd13d47b29ed3bbaafaff7d8b21e90d827631afda134836962011acb5904b71"},
-    {file = "mypy-1.6.1-cp312-cp312-win_amd64.whl", hash = "sha256:eb4f18589d196a4cbe5290b435d135dee96567e07c2b2d43b5c4621b6501531a"},
-    {file = "mypy-1.6.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:41697773aa0bf53ff917aa077e2cde7aa50254f28750f9b88884acea38a16169"},
-    {file = "mypy-1.6.1-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:7274b0c57737bd3476d2229c6389b2ec9eefeb090bbaf77777e9d6b1b5a9d143"},
-    {file = "mypy-1.6.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bbaf4662e498c8c2e352da5f5bca5ab29d378895fa2d980630656178bd607c46"},
-    {file = "mypy-1.6.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:bb8ccb4724f7d8601938571bf3f24da0da791fe2db7be3d9e79849cb64e0ae85"},
-    {file = "mypy-1.6.1-cp38-cp38-win_amd64.whl", hash = "sha256:68351911e85145f582b5aa6cd9ad666c8958bcae897a1bfda8f4940472463c45"},
-    {file = "mypy-1.6.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:49ae115da099dcc0922a7a895c1eec82c1518109ea5c162ed50e3b3594c71208"},
-    {file = "mypy-1.6.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:8b27958f8c76bed8edaa63da0739d76e4e9ad4ed325c814f9b3851425582a3cd"},
-    {file = "mypy-1.6.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:925cd6a3b7b55dfba252b7c4561892311c5358c6b5a601847015a1ad4eb7d332"},
-    {file = "mypy-1.6.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:8f57e6b6927a49550da3d122f0cb983d400f843a8a82e65b3b380d3d7259468f"},
-    {file = "mypy-1.6.1-cp39-cp39-win_amd64.whl", hash = "sha256:a43ef1c8ddfdb9575691720b6352761f3f53d85f1b57d7745701041053deff30"},
-    {file = "mypy-1.6.1-py3-none-any.whl", hash = "sha256:4cbe68ef919c28ea561165206a2dcb68591c50f3bcf777932323bc208d949cf1"},
-    {file = "mypy-1.6.1.tar.gz", hash = "sha256:4d01c00d09a0be62a4ca3f933e315455bde83f37f892ba4b08ce92f3cf44bcc1"},
-]
-
-[package.dependencies]
-mypy-extensions = ">=1.0.0"
-tomli = {version = ">=1.1.0", markers = "python_version < \"3.11\""}
-typing-extensions = ">=4.1.0"
-
-[package.extras]
-dmypy = ["psutil (>=4.0)"]
-install-types = ["pip"]
-reports = ["lxml"]
-
-[[package]]
-name = "mypy-extensions"
-version = "1.0.0"
-description = "Type system extensions for programs checked with the mypy type checker."
-category = "dev"
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "mypy_extensions-1.0.0-py3-none-any.whl", hash = "sha256:4392f6c0eb8a5668a69e23d168ffa70f0be9ccfd32b5cc2d26a34ae5b844552d"},
-    {file = "mypy_extensions-1.0.0.tar.gz", hash = "sha256:75dbf8955dc00442a438fc4d0666508a9a97b6bd41aa2f0ffe9d2f2725af0782"},
-]
-
-[[package]]
-name = "packageurl-python"
-version = "0.11.2"
-description = "A purl aka. Package URL parser and builder"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "packageurl-python-0.11.2.tar.gz", hash = "sha256:01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"},
-    {file = "packageurl_python-0.11.2-py3-none-any.whl", hash = "sha256:799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"},
-]
-
-[package.extras]
-build = ["wheel"]
-lint = ["black", "isort", "mypy"]
-sqlalchemy = ["sqlalchemy (>=2.0.0)"]
-test = ["pytest"]
-
-[[package]]
-name = "packaging"
-version = "23.2"
-description = "Core utilities for Python packages"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "packaging-23.2-py3-none-any.whl", hash = "sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7"},
-    {file = "packaging-23.2.tar.gz", hash = "sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5"},
-]
-
-[[package]]
-name = "pbr"
-version = "5.11.1"
-description = "Python Build Reasonableness"
-category = "dev"
-optional = false
-python-versions = ">=2.6"
-files = [
-    {file = "pbr-5.11.1-py2.py3-none-any.whl", hash = "sha256:567f09558bae2b3ab53cb3c1e2e33e726ff3338e7bae3db5dc954b3a44eef12b"},
-    {file = "pbr-5.11.1.tar.gz", hash = "sha256:aefc51675b0b533d56bb5fd1c8c6c0522fe31896679882e1c4c63d5e4a0fccb3"},
-]
-
-[[package]]
-name = "pip-requirements-parser"
-version = "32.0.1"
-description = "pip requirements parser - a mostly correct pip requirements parsing library because it uses pip's own code."
-category = "main"
-optional = false
-python-versions = ">=3.6.0"
-files = [
-    {file = "pip-requirements-parser-32.0.1.tar.gz", hash = "sha256:b4fa3a7a0be38243123cf9d1f3518da10c51bdb165a2b2985566247f9155a7d3"},
-    {file = "pip_requirements_parser-32.0.1-py3-none-any.whl", hash = "sha256:4659bc2a667783e7a15d190f6fccf8b2486685b6dba4c19c3876314769c57526"},
-]
-
-[package.dependencies]
-packaging = "*"
-pyparsing = "*"
-
-[package.extras]
-docs = ["Sphinx (>=3.3.1)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)"]
-testing = ["aboutcode-toolkit (>=6.0.0)", "black", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)"]
-
-[[package]]
-name = "pkgutil-resolve-name"
-version = "1.3.10"
-description = "Resolve a name to an object."
-category = "main"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "pkgutil_resolve_name-1.3.10-py3-none-any.whl", hash = "sha256:ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"},
-    {file = "pkgutil_resolve_name-1.3.10.tar.gz", hash = "sha256:357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"},
-]
-
-[[package]]
-name = "platformdirs"
-version = "3.11.0"
-description = "A small Python package for determining appropriate platform-specific dirs, e.g. a \"user data dir\"."
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "platformdirs-3.11.0-py3-none-any.whl", hash = "sha256:e9d171d00af68be50e9202731309c4e658fd8bc76f55c11c7dd760d023bda68e"},
-    {file = "platformdirs-3.11.0.tar.gz", hash = "sha256:cf8ee52a3afdb965072dcc652433e0c7e3e40cf5ea1477cd4b3b1d2eb75495b3"},
-]
-
-[package.extras]
-docs = ["furo (>=2023.7.26)", "proselint (>=0.13)", "sphinx (>=7.1.1)", "sphinx-autodoc-typehints (>=1.24)"]
-test = ["appdirs (==1.4.4)", "covdefaults (>=2.3)", "pytest (>=7.4)", "pytest-cov (>=4.1)", "pytest-mock (>=3.11.1)"]
-
-[[package]]
-name = "pluggy"
-version = "1.3.0"
-description = "plugin and hook calling mechanisms for python"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "pluggy-1.3.0-py3-none-any.whl", hash = "sha256:d89c696a773f8bd377d18e5ecda92b7a3793cbe66c87060a6fb58c7b6e1061f7"},
-    {file = "pluggy-1.3.0.tar.gz", hash = "sha256:cf61ae8f126ac6f7c451172cf30e3e43d3ca77615509771b3a984a0730651e12"},
-]
-
-[package.extras]
-dev = ["pre-commit", "tox"]
-testing = ["pytest", "pytest-benchmark"]
-
-[[package]]
-name = "py-serializable"
-version = "0.15.0"
-description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-files = [
-    {file = "py-serializable-0.15.0.tar.gz", hash = "sha256:8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"},
-    {file = "py_serializable-0.15.0-py3-none-any.whl", hash = "sha256:d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"},
-]
-
-[package.dependencies]
-defusedxml = ">=0.7.1,<0.8.0"
-
-[[package]]
-name = "pycodestyle"
-version = "2.11.1"
-description = "Python style guide checker"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "pycodestyle-2.11.1-py2.py3-none-any.whl", hash = "sha256:44fe31000b2d866f2e41841b18528a505fbd7fef9017b04eff4e2648a0fadc67"},
-    {file = "pycodestyle-2.11.1.tar.gz", hash = "sha256:41ba0e7afc9752dfb53ced5489e89f8186be00e599e712660695b7a75ff2663f"},
-]
-
-[[package]]
-name = "pyflakes"
-version = "3.1.0"
-description = "passive checker of Python programs"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "pyflakes-3.1.0-py2.py3-none-any.whl", hash = "sha256:4132f6d49cb4dae6819e5379898f2b8cce3c5f23994194c24b77d5da2e36f774"},
-    {file = "pyflakes-3.1.0.tar.gz", hash = "sha256:a0aae034c444db0071aa077972ba4768d40c830d9539fd45bf4cd3f8f6992efc"},
-]
-
-[[package]]
-name = "pygments"
-version = "2.16.1"
-description = "Pygments is a syntax highlighting package written in Python."
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "Pygments-2.16.1-py3-none-any.whl", hash = "sha256:13fc09fa63bc8d8671a6d247e1eb303c4b343eaee81d861f3404db2935653692"},
-    {file = "Pygments-2.16.1.tar.gz", hash = "sha256:1daff0494820c69bc8941e407aa20f577374ee88364ee10a98fdbe0aece96e29"},
-]
-
-[package.extras]
-plugins = ["importlib-metadata"]
-
-[[package]]
-name = "pyparsing"
-version = "3.1.1"
-description = "pyparsing module - Classes and methods to define and execute parsing grammars"
-category = "main"
-optional = false
-python-versions = ">=3.6.8"
-files = [
-    {file = "pyparsing-3.1.1-py3-none-any.whl", hash = "sha256:32c7c0b711493c72ff18a981d24f28aaf9c1fb7ed5e9667c9e84e3db623bdbfb"},
-    {file = "pyparsing-3.1.1.tar.gz", hash = "sha256:ede28a1a32462f5a9705e07aea48001a08f7cf81a021585011deba701581a0db"},
-]
-
-[package.extras]
-diagrams = ["jinja2", "railroad-diagrams"]
-
-[[package]]
-name = "pyproject-api"
-version = "1.6.1"
-description = "API to interact with the python pyproject.toml based projects"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "pyproject_api-1.6.1-py3-none-any.whl", hash = "sha256:4c0116d60476b0786c88692cf4e325a9814965e2469c5998b830bba16b183675"},
-    {file = "pyproject_api-1.6.1.tar.gz", hash = "sha256:1817dc018adc0d1ff9ca1ed8c60e1623d5aaca40814b953af14a9cf9a5cae538"},
-]
-
-[package.dependencies]
-packaging = ">=23.1"
-tomli = {version = ">=2.0.1", markers = "python_version < \"3.11\""}
-
-[package.extras]
-docs = ["furo (>=2023.8.19)", "sphinx (<7.2)", "sphinx-autodoc-typehints (>=1.24)"]
-testing = ["covdefaults (>=2.3)", "pytest (>=7.4)", "pytest-cov (>=4.1)", "pytest-mock (>=3.11.1)", "setuptools (>=68.1.2)", "wheel (>=0.41.2)"]
-
-[[package]]
-name = "python-dateutil"
-version = "2.8.2"
-description = "Extensions to the standard Python datetime module"
-category = "main"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-files = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
-]
-
-[package.dependencies]
-six = ">=1.5"
-
-[[package]]
-name = "pyyaml"
-version = "6.0.1"
-description = "YAML parser and emitter for Python"
-category = "dev"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "PyYAML-6.0.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:d858aa552c999bc8a8d57426ed01e40bef403cd8ccdd0fc5f6f04a00414cac2a"},
-    {file = "PyYAML-6.0.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:fd66fc5d0da6d9815ba2cebeb4205f95818ff4b79c3ebe268e75d961704af52f"},
-    {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:69b023b2b4daa7548bcfbd4aa3da05b3a74b772db9e23b982788168117739938"},
-    {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:81e0b275a9ecc9c0c0c07b4b90ba548307583c125f54d5b6946cfee6360c733d"},
-    {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba336e390cd8e4d1739f42dfe9bb83a3cc2e80f567d8805e11b46f4a943f5515"},
-    {file = "PyYAML-6.0.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:326c013efe8048858a6d312ddd31d56e468118ad4cdeda36c719bf5bb6192290"},
-    {file = "PyYAML-6.0.1-cp310-cp310-win32.whl", hash = "sha256:bd4af7373a854424dabd882decdc5579653d7868b8fb26dc7d0e99f823aa5924"},
-    {file = "PyYAML-6.0.1-cp310-cp310-win_amd64.whl", hash = "sha256:fd1592b3fdf65fff2ad0004b5e363300ef59ced41c2e6b3a99d4089fa8c5435d"},
-    {file = "PyYAML-6.0.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6965a7bc3cf88e5a1c3bd2e0b5c22f8d677dc88a455344035f03399034eb3007"},
-    {file = "PyYAML-6.0.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f003ed9ad21d6a4713f0a9b5a7a0a79e08dd0f221aff4525a2be4c346ee60aab"},
-    {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:42f8152b8dbc4fe7d96729ec2b99c7097d656dc1213a3229ca5383f973a5ed6d"},
-    {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:062582fca9fabdd2c8b54a3ef1c978d786e0f6b3a1510e0ac93ef59e0ddae2bc"},
-    {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d2b04aac4d386b172d5b9692e2d2da8de7bfb6c387fa4f801fbf6fb2e6ba4673"},
-    {file = "PyYAML-6.0.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:e7d73685e87afe9f3b36c799222440d6cf362062f78be1013661b00c5c6f678b"},
-    {file = "PyYAML-6.0.1-cp311-cp311-win32.whl", hash = "sha256:1635fd110e8d85d55237ab316b5b011de701ea0f29d07611174a1b42f1444741"},
-    {file = "PyYAML-6.0.1-cp311-cp311-win_amd64.whl", hash = "sha256:bf07ee2fef7014951eeb99f56f39c9bb4af143d8aa3c21b1677805985307da34"},
-    {file = "PyYAML-6.0.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:855fb52b0dc35af121542a76b9a84f8d1cd886ea97c84703eaa6d88e37a2ad28"},
-    {file = "PyYAML-6.0.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:40df9b996c2b73138957fe23a16a4f0ba614f4c0efce1e9406a184b6d07fa3a9"},
-    {file = "PyYAML-6.0.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c22bec3fbe2524cde73d7ada88f6566758a8f7227bfbf93a408a9d86bcc12a0"},
-    {file = "PyYAML-6.0.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:8d4e9c88387b0f5c7d5f281e55304de64cf7f9c0021a3525bd3b1c542da3b0e4"},
-    {file = "PyYAML-6.0.1-cp312-cp312-win32.whl", hash = "sha256:d483d2cdf104e7c9fa60c544d92981f12ad66a457afae824d146093b8c294c54"},
-    {file = "PyYAML-6.0.1-cp312-cp312-win_amd64.whl", hash = "sha256:0d3304d8c0adc42be59c5f8a4d9e3d7379e6955ad754aa9d6ab7a398b59dd1df"},
-    {file = "PyYAML-6.0.1-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:50550eb667afee136e9a77d6dc71ae76a44df8b3e51e41b77f6de2932bfe0f47"},
-    {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1fe35611261b29bd1de0070f0b2f47cb6ff71fa6595c077e42bd0c419fa27b98"},
-    {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:704219a11b772aea0d8ecd7058d0082713c3562b4e271b849ad7dc4a5c90c13c"},
-    {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:afd7e57eddb1a54f0f1a974bc4391af8bcce0b444685d936840f125cf046d5bd"},
-    {file = "PyYAML-6.0.1-cp36-cp36m-win32.whl", hash = "sha256:fca0e3a251908a499833aa292323f32437106001d436eca0e6e7833256674585"},
-    {file = "PyYAML-6.0.1-cp36-cp36m-win_amd64.whl", hash = "sha256:f22ac1c3cac4dbc50079e965eba2c1058622631e526bd9afd45fedd49ba781fa"},
-    {file = "PyYAML-6.0.1-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:b1275ad35a5d18c62a7220633c913e1b42d44b46ee12554e5fd39c70a243d6a3"},
-    {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:18aeb1bf9a78867dc38b259769503436b7c72f7a1f1f4c93ff9a17de54319b27"},
-    {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:596106435fa6ad000c2991a98fa58eeb8656ef2325d7e158344fb33864ed87e3"},
-    {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:baa90d3f661d43131ca170712d903e6295d1f7a0f595074f151c0aed377c9b9c"},
-    {file = "PyYAML-6.0.1-cp37-cp37m-win32.whl", hash = "sha256:9046c58c4395dff28dd494285c82ba00b546adfc7ef001486fbf0324bc174fba"},
-    {file = "PyYAML-6.0.1-cp37-cp37m-win_amd64.whl", hash = "sha256:4fb147e7a67ef577a588a0e2c17b6db51dda102c71de36f8549b6816a96e1867"},
-    {file = "PyYAML-6.0.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:1d4c7e777c441b20e32f52bd377e0c409713e8bb1386e1099c2415f26e479595"},
-    {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a0cd17c15d3bb3fa06978b4e8958dcdc6e0174ccea823003a106c7d4d7899ac5"},
-    {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:28c119d996beec18c05208a8bd78cbe4007878c6dd15091efb73a30e90539696"},
-    {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7e07cbde391ba96ab58e532ff4803f79c4129397514e1413a7dc761ccd755735"},
-    {file = "PyYAML-6.0.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:49a183be227561de579b4a36efbb21b3eab9651dd81b1858589f796549873dd6"},
-    {file = "PyYAML-6.0.1-cp38-cp38-win32.whl", hash = "sha256:184c5108a2aca3c5b3d3bf9395d50893a7ab82a38004c8f61c258d4428e80206"},
-    {file = "PyYAML-6.0.1-cp38-cp38-win_amd64.whl", hash = "sha256:1e2722cc9fbb45d9b87631ac70924c11d3a401b2d7f410cc0e3bbf249f2dca62"},
-    {file = "PyYAML-6.0.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:9eb6caa9a297fc2c2fb8862bc5370d0303ddba53ba97e71f08023b6cd73d16a8"},
-    {file = "PyYAML-6.0.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:c8098ddcc2a85b61647b2590f825f3db38891662cfc2fc776415143f599bb859"},
-    {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5773183b6446b2c99bb77e77595dd486303b4faab2b086e7b17bc6bef28865f6"},
-    {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b786eecbdf8499b9ca1d697215862083bd6d2a99965554781d0d8d1ad31e13a0"},
-    {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc1bf2925a1ecd43da378f4db9e4f799775d6367bdb94671027b73b393a7c42c"},
-    {file = "PyYAML-6.0.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:04ac92ad1925b2cff1db0cfebffb6ffc43457495c9b3c39d3fcae417d7125dc5"},
-    {file = "PyYAML-6.0.1-cp39-cp39-win32.whl", hash = "sha256:faca3bdcf85b2fc05d06ff3fbc1f83e1391b3e724afa3feba7d13eeab355484c"},
-    {file = "PyYAML-6.0.1-cp39-cp39-win_amd64.whl", hash = "sha256:510c9deebc5c0225e8c96813043e62b680ba2f9c50a08d3724c7f28a747d1486"},
-    {file = "PyYAML-6.0.1.tar.gz", hash = "sha256:bfdf460b1736c775f2ba9f6a92bca30bc2095067b8a9d77876d1fad6cc3b4a43"},
-]
-
-[[package]]
-name = "referencing"
-version = "0.30.2"
-description = "JSON Referencing + Python"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "referencing-0.30.2-py3-none-any.whl", hash = "sha256:449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"},
-    {file = "referencing-0.30.2.tar.gz", hash = "sha256:794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"},
-]
-
-[package.dependencies]
-attrs = ">=22.2.0"
-rpds-py = ">=0.7.0"
-
-[[package]]
-name = "rfc3339-validator"
-version = "0.1.4"
-description = "A pure python RFC3339 validator"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-files = [
-    {file = "rfc3339_validator-0.1.4-py2.py3-none-any.whl", hash = "sha256:24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"},
-    {file = "rfc3339_validator-0.1.4.tar.gz", hash = "sha256:138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"},
-]
-
-[package.dependencies]
-six = "*"
-
-[[package]]
-name = "rfc3987"
-version = "1.3.8"
-description = "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "rfc3987-1.3.8-py2.py3-none-any.whl", hash = "sha256:10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"},
-    {file = "rfc3987-1.3.8.tar.gz", hash = "sha256:d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"},
-]
-
-[[package]]
-name = "rich"
-version = "13.6.0"
-description = "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal"
-category = "dev"
-optional = false
-python-versions = ">=3.7.0"
-files = [
-    {file = "rich-13.6.0-py3-none-any.whl", hash = "sha256:2b38e2fe9ca72c9a00170a1a2d20c63c790d0e10ef1fe35eba76e1e7b1d7d245"},
-    {file = "rich-13.6.0.tar.gz", hash = "sha256:5c14d22737e6d5084ef4771b62d5d4363165b403455a30a1c8ca39dc7b644bef"},
-]
-
-[package.dependencies]
-markdown-it-py = ">=2.2.0"
-pygments = ">=2.13.0,<3.0.0"
-typing-extensions = {version = ">=4.0.0,<5.0", markers = "python_version < \"3.9\""}
-
-[package.extras]
-jupyter = ["ipywidgets (>=7.5.1,<9)"]
-
-[[package]]
-name = "rpds-py"
-version = "0.10.6"
-description = "Python bindings to Rust's persistent data structures (rpds)"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "rpds_py-0.10.6-cp310-cp310-macosx_10_7_x86_64.whl", hash = "sha256:6bdc11f9623870d75692cc33c59804b5a18d7b8a4b79ef0b00b773a27397d1f6"},
-    {file = "rpds_py-0.10.6-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:26857f0f44f0e791f4a266595a7a09d21f6b589580ee0585f330aaccccb836e3"},
-    {file = "rpds_py-0.10.6-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d7f5e15c953ace2e8dde9824bdab4bec50adb91a5663df08d7d994240ae6fa31"},
-    {file = "rpds_py-0.10.6-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:61fa268da6e2e1cd350739bb61011121fa550aa2545762e3dc02ea177ee4de35"},
-    {file = "rpds_py-0.10.6-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c48f3fbc3e92c7dd6681a258d22f23adc2eb183c8cb1557d2fcc5a024e80b094"},
-    {file = "rpds_py-0.10.6-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c0503c5b681566e8b722fe8c4c47cce5c7a51f6935d5c7012c4aefe952a35eed"},
-    {file = "rpds_py-0.10.6-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:734c41f9f57cc28658d98270d3436dba65bed0cfc730d115b290e970150c540d"},
-    {file = "rpds_py-0.10.6-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:a5d7ed104d158c0042a6a73799cf0eb576dfd5fc1ace9c47996e52320c37cb7c"},
-    {file = "rpds_py-0.10.6-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:e3df0bc35e746cce42579826b89579d13fd27c3d5319a6afca9893a9b784ff1b"},
-    {file = "rpds_py-0.10.6-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:73e0a78a9b843b8c2128028864901f55190401ba38aae685350cf69b98d9f7c9"},
-    {file = "rpds_py-0.10.6-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5ed505ec6305abd2c2c9586a7b04fbd4baf42d4d684a9c12ec6110deefe2a063"},
-    {file = "rpds_py-0.10.6-cp310-none-win32.whl", hash = "sha256:d97dd44683802000277bbf142fd9f6b271746b4846d0acaf0cefa6b2eaf2a7ad"},
-    {file = "rpds_py-0.10.6-cp310-none-win_amd64.whl", hash = "sha256:b455492cab07107bfe8711e20cd920cc96003e0da3c1f91297235b1603d2aca7"},
-    {file = "rpds_py-0.10.6-cp311-cp311-macosx_10_7_x86_64.whl", hash = "sha256:e8cdd52744f680346ff8c1ecdad5f4d11117e1724d4f4e1874f3a67598821069"},
-    {file = "rpds_py-0.10.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:66414dafe4326bca200e165c2e789976cab2587ec71beb80f59f4796b786a238"},
-    {file = "rpds_py-0.10.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cc435d059f926fdc5b05822b1be4ff2a3a040f3ae0a7bbbe672babb468944722"},
-    {file = "rpds_py-0.10.6-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8e7f2219cb72474571974d29a191714d822e58be1eb171f229732bc6fdedf0ac"},
-    {file = "rpds_py-0.10.6-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3953c6926a63f8ea5514644b7afb42659b505ece4183fdaaa8f61d978754349e"},
-    {file = "rpds_py-0.10.6-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2bb2e4826be25e72013916eecd3d30f66fd076110de09f0e750163b416500721"},
-    {file = "rpds_py-0.10.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7bf347b495b197992efc81a7408e9a83b931b2f056728529956a4d0858608b80"},
-    {file = "rpds_py-0.10.6-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:102eac53bb0bf0f9a275b438e6cf6904904908562a1463a6fc3323cf47d7a532"},
-    {file = "rpds_py-0.10.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:40f93086eef235623aa14dbddef1b9fb4b22b99454cb39a8d2e04c994fb9868c"},
-    {file = "rpds_py-0.10.6-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:e22260a4741a0e7a206e175232867b48a16e0401ef5bce3c67ca5b9705879066"},
-    {file = "rpds_py-0.10.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f4e56860a5af16a0fcfa070a0a20c42fbb2012eed1eb5ceeddcc7f8079214281"},
-    {file = "rpds_py-0.10.6-cp311-none-win32.whl", hash = "sha256:0774a46b38e70fdde0c6ded8d6d73115a7c39d7839a164cc833f170bbf539116"},
-    {file = "rpds_py-0.10.6-cp311-none-win_amd64.whl", hash = "sha256:4a5ee600477b918ab345209eddafde9f91c0acd931f3776369585a1c55b04c57"},
-    {file = "rpds_py-0.10.6-cp312-cp312-macosx_10_7_x86_64.whl", hash = "sha256:5ee97c683eaface61d38ec9a489e353d36444cdebb128a27fe486a291647aff6"},
-    {file = "rpds_py-0.10.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:0713631d6e2d6c316c2f7b9320a34f44abb644fc487b77161d1724d883662e31"},
-    {file = "rpds_py-0.10.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b5a53f5998b4bbff1cb2e967e66ab2addc67326a274567697379dd1e326bded7"},
-    {file = "rpds_py-0.10.6-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6a555ae3d2e61118a9d3e549737bb4a56ff0cec88a22bd1dfcad5b4e04759175"},
-    {file = "rpds_py-0.10.6-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:945eb4b6bb8144909b203a88a35e0a03d22b57aefb06c9b26c6e16d72e5eb0f0"},
-    {file = "rpds_py-0.10.6-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:52c215eb46307c25f9fd2771cac8135d14b11a92ae48d17968eda5aa9aaf5071"},
-    {file = "rpds_py-0.10.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c1b3cd23d905589cb205710b3988fc8f46d4a198cf12862887b09d7aaa6bf9b9"},
-    {file = "rpds_py-0.10.6-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:64ccc28683666672d7c166ed465c09cee36e306c156e787acef3c0c62f90da5a"},
-    {file = "rpds_py-0.10.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:516a611a2de12fbea70c78271e558f725c660ce38e0006f75139ba337d56b1f6"},
-    {file = "rpds_py-0.10.6-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:9ff93d3aedef11f9c4540cf347f8bb135dd9323a2fc705633d83210d464c579d"},
-    {file = "rpds_py-0.10.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:d858532212f0650be12b6042ff4378dc2efbb7792a286bee4489eaa7ba010586"},
-    {file = "rpds_py-0.10.6-cp312-none-win32.whl", hash = "sha256:3c4eff26eddac49d52697a98ea01b0246e44ca82ab09354e94aae8823e8bda02"},
-    {file = "rpds_py-0.10.6-cp312-none-win_amd64.whl", hash = "sha256:150eec465dbc9cbca943c8e557a21afdcf9bab8aaabf386c44b794c2f94143d2"},
-    {file = "rpds_py-0.10.6-cp38-cp38-macosx_10_7_x86_64.whl", hash = "sha256:cf693eb4a08eccc1a1b636e4392322582db2a47470d52e824b25eca7a3977b53"},
-    {file = "rpds_py-0.10.6-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:4134aa2342f9b2ab6c33d5c172e40f9ef802c61bb9ca30d21782f6e035ed0043"},
-    {file = "rpds_py-0.10.6-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e782379c2028a3611285a795b89b99a52722946d19fc06f002f8b53e3ea26ea9"},
-    {file = "rpds_py-0.10.6-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2f6da6d842195fddc1cd34c3da8a40f6e99e4a113918faa5e60bf132f917c247"},
-    {file = "rpds_py-0.10.6-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b4a9fe992887ac68256c930a2011255bae0bf5ec837475bc6f7edd7c8dfa254e"},
-    {file = "rpds_py-0.10.6-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b788276a3c114e9f51e257f2a6f544c32c02dab4aa7a5816b96444e3f9ffc336"},
-    {file = "rpds_py-0.10.6-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:caa1afc70a02645809c744eefb7d6ee8fef7e2fad170ffdeacca267fd2674f13"},
-    {file = "rpds_py-0.10.6-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:bddd4f91eede9ca5275e70479ed3656e76c8cdaaa1b354e544cbcf94c6fc8ac4"},
-    {file = "rpds_py-0.10.6-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:775049dfa63fb58293990fc59473e659fcafd953bba1d00fc5f0631a8fd61977"},
-    {file = "rpds_py-0.10.6-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:c6c45a2d2b68c51fe3d9352733fe048291e483376c94f7723458cfd7b473136b"},
-    {file = "rpds_py-0.10.6-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:0699ab6b8c98df998c3eacf51a3b25864ca93dab157abe358af46dc95ecd9801"},
-    {file = "rpds_py-0.10.6-cp38-none-win32.whl", hash = "sha256:ebdab79f42c5961682654b851f3f0fc68e6cc7cd8727c2ac4ffff955154123c1"},
-    {file = "rpds_py-0.10.6-cp38-none-win_amd64.whl", hash = "sha256:24656dc36f866c33856baa3ab309da0b6a60f37d25d14be916bd3e79d9f3afcf"},
-    {file = "rpds_py-0.10.6-cp39-cp39-macosx_10_7_x86_64.whl", hash = "sha256:0898173249141ee99ffcd45e3829abe7bcee47d941af7434ccbf97717df020e5"},
-    {file = "rpds_py-0.10.6-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:9e9184fa6c52a74a5521e3e87badbf9692549c0fcced47443585876fcc47e469"},
-    {file = "rpds_py-0.10.6-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5752b761902cd15073a527b51de76bbae63d938dc7c5c4ad1e7d8df10e765138"},
-    {file = "rpds_py-0.10.6-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:99a57006b4ec39dbfb3ed67e5b27192792ffb0553206a107e4aadb39c5004cd5"},
-    {file = "rpds_py-0.10.6-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:09586f51a215d17efdb3a5f090d7cbf1633b7f3708f60a044757a5d48a83b393"},
-    {file = "rpds_py-0.10.6-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e225a6a14ecf44499aadea165299092ab0cba918bb9ccd9304eab1138844490b"},
-    {file = "rpds_py-0.10.6-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b2039f8d545f20c4e52713eea51a275e62153ee96c8035a32b2abb772b6fc9e5"},
-    {file = "rpds_py-0.10.6-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:34ad87a831940521d462ac11f1774edf867c34172010f5390b2f06b85dcc6014"},
-    {file = "rpds_py-0.10.6-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:dcdc88b6b01015da066da3fb76545e8bb9a6880a5ebf89e0f0b2e3ca557b3ab7"},
-    {file = "rpds_py-0.10.6-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:25860ed5c4e7f5e10c496ea78af46ae8d8468e0be745bd233bab9ca99bfd2647"},
-    {file = "rpds_py-0.10.6-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:7854a207ef77319ec457c1eb79c361b48807d252d94348305db4f4b62f40f7f3"},
-    {file = "rpds_py-0.10.6-cp39-none-win32.whl", hash = "sha256:e6fcc026a3f27c1282c7ed24b7fcac82cdd70a0e84cc848c0841a3ab1e3dea2d"},
-    {file = "rpds_py-0.10.6-cp39-none-win_amd64.whl", hash = "sha256:e98c4c07ee4c4b3acf787e91b27688409d918212dfd34c872201273fdd5a0e18"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-macosx_10_7_x86_64.whl", hash = "sha256:68fe9199184c18d997d2e4293b34327c0009a78599ce703e15cd9a0f47349bba"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:3339eca941568ed52d9ad0f1b8eb9fe0958fa245381747cecf2e9a78a5539c42"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a360cfd0881d36c6dc271992ce1eda65dba5e9368575663de993eeb4523d895f"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:031f76fc87644a234883b51145e43985aa2d0c19b063e91d44379cd2786144f8"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1f36a9d751f86455dc5278517e8b65580eeee37d61606183897f122c9e51cef3"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:052a832078943d2b2627aea0d19381f607fe331cc0eb5df01991268253af8417"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:023574366002bf1bd751ebaf3e580aef4a468b3d3c216d2f3f7e16fdabd885ed"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:defa2c0c68734f4a82028c26bcc85e6b92cced99866af118cd6a89b734ad8e0d"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:879fb24304ead6b62dbe5034e7b644b71def53c70e19363f3c3be2705c17a3b4"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-musllinux_1_2_i686.whl", hash = "sha256:53c43e10d398e365da2d4cc0bcaf0854b79b4c50ee9689652cdc72948e86f487"},
-    {file = "rpds_py-0.10.6-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:3777cc9dea0e6c464e4b24760664bd8831738cc582c1d8aacf1c3f546bef3f65"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-macosx_10_7_x86_64.whl", hash = "sha256:40578a6469e5d1df71b006936ce95804edb5df47b520c69cf5af264d462f2cbb"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-macosx_11_0_arm64.whl", hash = "sha256:cf71343646756a072b85f228d35b1d7407da1669a3de3cf47f8bbafe0c8183a4"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:10f32b53f424fc75ff7b713b2edb286fdbfc94bf16317890260a81c2c00385dc"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:81de24a1c51cfb32e1fbf018ab0bdbc79c04c035986526f76c33e3f9e0f3356c"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ac17044876e64a8ea20ab132080ddc73b895b4abe9976e263b0e30ee5be7b9c2"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5e8a78bd4879bff82daef48c14d5d4057f6856149094848c3ed0ecaf49f5aec2"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:78ca33811e1d95cac8c2e49cb86c0fb71f4d8409d8cbea0cb495b6dbddb30a55"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c63c3ef43f0b3fb00571cff6c3967cc261c0ebd14a0a134a12e83bdb8f49f21f"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:7fde6d0e00b2fd0dbbb40c0eeec463ef147819f23725eda58105ba9ca48744f4"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-musllinux_1_2_i686.whl", hash = "sha256:79edd779cfc46b2e15b0830eecd8b4b93f1a96649bcb502453df471a54ce7977"},
-    {file = "rpds_py-0.10.6-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:9164ec8010327ab9af931d7ccd12ab8d8b5dc2f4c6a16cbdd9d087861eaaefa1"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-macosx_10_7_x86_64.whl", hash = "sha256:d29ddefeab1791e3c751e0189d5f4b3dbc0bbe033b06e9c333dca1f99e1d523e"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:30adb75ecd7c2a52f5e76af50644b3e0b5ba036321c390b8e7ec1bb2a16dd43c"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dd609fafdcdde6e67a139898196698af37438b035b25ad63704fd9097d9a3482"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6eef672de005736a6efd565577101277db6057f65640a813de6c2707dc69f396"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:6cf4393c7b41abbf07c88eb83e8af5013606b1cdb7f6bc96b1b3536b53a574b8"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ad857f42831e5b8d41a32437f88d86ead6c191455a3499c4b6d15e007936d4cf"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1d7360573f1e046cb3b0dceeb8864025aa78d98be4bb69f067ec1c40a9e2d9df"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:d08f63561c8a695afec4975fae445245386d645e3e446e6f260e81663bfd2e38"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:f0f17f2ce0f3529177a5fff5525204fad7b43dd437d017dd0317f2746773443d"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-musllinux_1_2_i686.whl", hash = "sha256:442626328600bde1d09dc3bb00434f5374948838ce75c41a52152615689f9403"},
-    {file = "rpds_py-0.10.6-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:e9616f5bd2595f7f4a04b67039d890348ab826e943a9bfdbe4938d0eba606971"},
-    {file = "rpds_py-0.10.6.tar.gz", hash = "sha256:4ce5a708d65a8dbf3748d2474b580d606b1b9f91b5c6ab2a316e0b0cf7a4ba50"},
-]
-
-[[package]]
-name = "setuptools"
-version = "68.2.2"
-description = "Easily download, build, install, upgrade, and uninstall Python packages"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "setuptools-68.2.2-py3-none-any.whl", hash = "sha256:b454a35605876da60632df1a60f736524eb73cc47bbc9f3f1ef1b644de74fd2a"},
-    {file = "setuptools-68.2.2.tar.gz", hash = "sha256:4ac1475276d2f1c48684874089fefcd83bd7162ddaafb81fac866ba0db282a87"},
-]
-
-[package.extras]
-docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-hoverxref (<2)", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (>=1,<2)", "sphinx-reredirects", "sphinxcontrib-towncrier"]
-testing = ["build[virtualenv]", "filelock (>=3.4.0)", "flake8-2020", "ini2toml[lite] (>=0.9)", "jaraco.develop (>=7.21)", "jaraco.envs (>=2.2)", "jaraco.path (>=3.2.0)", "pip (>=19.1)", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-mypy (>=0.9.1)", "pytest-perf", "pytest-ruff", "pytest-timeout", "pytest-xdist", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel"]
-testing-integration = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "jaraco.envs (>=2.2)", "jaraco.path (>=3.2.0)", "packaging (>=23.1)", "pytest", "pytest-enabler", "pytest-xdist", "tomli", "virtualenv (>=13.0.0)", "wheel"]
-
-[[package]]
-name = "six"
-version = "1.16.0"
-description = "Python 2 and 3 compatibility utilities"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-
-[[package]]
-name = "smmap"
-version = "5.0.1"
-description = "A pure Python implementation of a sliding window memory map manager"
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "smmap-5.0.1-py3-none-any.whl", hash = "sha256:e6d8668fa5f93e706934a62d7b4db19c8d9eb8cf2adbb75ef1b675aa332b69da"},
-    {file = "smmap-5.0.1.tar.gz", hash = "sha256:dceeb6c0028fdb6734471eb07c0cd2aae706ccaecab45965ee83f11c8d3b1f62"},
-]
-
-[[package]]
-name = "sortedcontainers"
-version = "2.4.0"
-description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
-    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
-]
-
-[[package]]
-name = "stevedore"
-version = "5.1.0"
-description = "Manage dynamic plugins for Python applications"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "stevedore-5.1.0-py3-none-any.whl", hash = "sha256:8cc040628f3cea5d7128f2e76cf486b2251a4e543c7b938f58d9a377f6694a2d"},
-    {file = "stevedore-5.1.0.tar.gz", hash = "sha256:a54534acf9b89bc7ed264807013b505bf07f74dbe4bcfa37d32bd063870b087c"},
-]
-
-[package.dependencies]
-pbr = ">=2.0.0,<2.1.0 || >2.1.0"
-
-[[package]]
-name = "toml"
-version = "0.10.2"
-description = "Python Library for Tom's Obvious, Minimal Language"
-category = "main"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
-
-[[package]]
-name = "tomli"
-version = "2.0.1"
-description = "A lil' TOML parser"
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "tomli-2.0.1-py3-none-any.whl", hash = "sha256:939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc"},
-    {file = "tomli-2.0.1.tar.gz", hash = "sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f"},
-]
-
-[[package]]
-name = "tox"
-version = "4.11.3"
-description = "tox is a generic virtualenv management and test command line tool"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "tox-4.11.3-py3-none-any.whl", hash = "sha256:599af5e5bb0cad0148ac1558a0b66f8fff219ef88363483b8d92a81e4246f28f"},
-    {file = "tox-4.11.3.tar.gz", hash = "sha256:5039f68276461fae6a9452a3b2c7295798f00a0e92edcd9a3b78ba1a73577951"},
-]
-
-[package.dependencies]
-cachetools = ">=5.3.1"
-chardet = ">=5.2"
-colorama = ">=0.4.6"
-filelock = ">=3.12.3"
-packaging = ">=23.1"
-platformdirs = ">=3.10"
-pluggy = ">=1.3"
-pyproject-api = ">=1.6.1"
-tomli = {version = ">=2.0.1", markers = "python_version < \"3.11\""}
-virtualenv = ">=20.24.3"
-
-[package.extras]
-docs = ["furo (>=2023.8.19)", "sphinx (>=7.2.4)", "sphinx-argparse-cli (>=1.11.1)", "sphinx-autodoc-typehints (>=1.24)", "sphinx-copybutton (>=0.5.2)", "sphinx-inline-tabs (>=2023.4.21)", "sphinxcontrib-towncrier (>=0.2.1a0)", "towncrier (>=23.6)"]
-testing = ["build[virtualenv] (>=0.10)", "covdefaults (>=2.3)", "detect-test-pollution (>=1.1.1)", "devpi-process (>=1)", "diff-cover (>=7.7)", "distlib (>=0.3.7)", "flaky (>=3.7)", "hatch-vcs (>=0.3)", "hatchling (>=1.18)", "psutil (>=5.9.5)", "pytest (>=7.4)", "pytest-cov (>=4.1)", "pytest-mock (>=3.11.1)", "pytest-xdist (>=3.3.1)", "re-assert (>=1.1)", "time-machine (>=2.12)", "wheel (>=0.41.2)"]
-
-[[package]]
-name = "types-python-dateutil"
-version = "2.8.19.14"
-description = "Typing stubs for python-dateutil"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
-    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
-]
-
-[[package]]
-name = "types-setuptools"
-version = "68.2.0.0"
-description = "Typing stubs for setuptools"
-category = "dev"
-optional = false
-python-versions = "*"
-files = [
-    {file = "types-setuptools-68.2.0.0.tar.gz", hash = "sha256:a4216f1e2ef29d089877b3af3ab2acf489eb869ccaf905125c69d2dc3932fd85"},
-    {file = "types_setuptools-68.2.0.0-py3-none-any.whl", hash = "sha256:77edcc843e53f8fc83bb1a840684841f3dc804ec94562623bfa2ea70d5a2ba1b"},
-]
-
-[[package]]
-name = "types-toml"
-version = "0.10.8.7"
-description = "Typing stubs for toml"
-category = "dev"
-optional = false
-python-versions = "*"
-files = [
-    {file = "types-toml-0.10.8.7.tar.gz", hash = "sha256:58b0781c681e671ff0b5c0319309910689f4ab40e8a2431e205d70c94bb6efb1"},
-    {file = "types_toml-0.10.8.7-py3-none-any.whl", hash = "sha256:61951da6ad410794c97bec035d59376ce1cbf4453dc9b6f90477e81e4442d631"},
-]
-
-[[package]]
-name = "typing-extensions"
-version = "4.8.0"
-description = "Backported and Experimental Type Hints for Python 3.8+"
-category = "dev"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "typing_extensions-4.8.0-py3-none-any.whl", hash = "sha256:8f92fc8806f9a6b641eaa5318da32b44d401efaac0f6678c9bc448ba3605faa0"},
-    {file = "typing_extensions-4.8.0.tar.gz", hash = "sha256:df8e4339e9cb77357558cbdbceca33c303714cf861d1eef15e1070055ae8b7ef"},
-]
-
-[[package]]
-name = "uri-template"
-version = "1.3.0"
-description = "RFC 6570 URI Template Processor"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "uri-template-1.3.0.tar.gz", hash = "sha256:0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"},
-    {file = "uri_template-1.3.0-py3-none-any.whl", hash = "sha256:a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"},
-]
-
-[package.extras]
-dev = ["flake8", "flake8-annotations", "flake8-bandit", "flake8-bugbear", "flake8-commas", "flake8-comprehensions", "flake8-continuation", "flake8-datetimez", "flake8-docstrings", "flake8-import-order", "flake8-literal", "flake8-modern-annotations", "flake8-noqa", "flake8-pyproject", "flake8-requirements", "flake8-typechecking-import", "flake8-use-fstring", "mypy", "pep8-naming", "types-PyYAML"]
-
-[[package]]
-name = "virtualenv"
-version = "20.24.6"
-description = "Virtual Python Environment builder"
-category = "dev"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "virtualenv-20.24.6-py3-none-any.whl", hash = "sha256:520d056652454c5098a00c0f073611ccbea4c79089331f60bf9d7ba247bb7381"},
-    {file = "virtualenv-20.24.6.tar.gz", hash = "sha256:02ece4f56fbf939dbbc33c0715159951d6bf14aaf5457b092e4548e1382455af"},
-]
-
-[package.dependencies]
-distlib = ">=0.3.7,<1"
-filelock = ">=3.12.2,<4"
-platformdirs = ">=3.9.1,<4"
-
-[package.extras]
-docs = ["furo (>=2023.7.26)", "proselint (>=0.13)", "sphinx (>=7.1.2)", "sphinx-argparse (>=0.4)", "sphinxcontrib-towncrier (>=0.2.1a0)", "towncrier (>=23.6)"]
-test = ["covdefaults (>=2.3)", "coverage (>=7.2.7)", "coverage-enable-subprocess (>=1)", "flaky (>=3.7)", "packaging (>=23.1)", "pytest (>=7.4)", "pytest-env (>=0.8.2)", "pytest-freezer (>=0.4.8)", "pytest-mock (>=3.11.1)", "pytest-randomly (>=3.12)", "pytest-timeout (>=2.1)", "setuptools (>=68)", "time-machine (>=2.10)"]
-
-[[package]]
-name = "webcolors"
-version = "1.13"
-description = "A library for working with the color formats defined by HTML and CSS."
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "webcolors-1.13-py3-none-any.whl", hash = "sha256:29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"},
-    {file = "webcolors-1.13.tar.gz", hash = "sha256:c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"},
-]
-
-[package.extras]
-docs = ["furo", "sphinx", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-notfound-page", "sphinxext-opengraph"]
-tests = ["pytest", "pytest-cov"]
-
-[[package]]
-name = "zipp"
-version = "3.17.0"
-description = "Backport of pathlib-compatible object wrapper for zip files"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "zipp-3.17.0-py3-none-any.whl", hash = "sha256:0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"},
-    {file = "zipp-3.17.0.tar.gz", hash = "sha256:84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"},
-]
-
-[package.extras]
-docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
-testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-ignore-flaky", "pytest-mypy (>=0.9.1)", "pytest-ruff"]
-
-[metadata]
-lock-version = "2.0"
-python-versions = "^3.8"
-content-hash = "7e410d8f751215f035bfad448ade1f2123914538be86085c166c75706e63b56d"
diff --git a/pyproject.toml b/pyproject.toml
index 48dc2550..ac2fabf6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -37,6 +37,7 @@ classifiers = [
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
     'Programming Language :: Python :: 3.11',
+    'Programming Language :: Python :: 3.12',
     'Typing :: Typed'
 ]
 

From 0e06e17c81d2e032cfc3f689377520f6496aeee2 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 12:36:53 +0100
Subject: [PATCH 044/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/python.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index a6970744..df51b5b5 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -123,7 +123,7 @@ jobs:
         run: poetry run tox run -e bandit -s false
 
   install-and-run:
-    name: install & run "${{matrix.command}}" (${{matrix.os}} py${{matrox.python-version}})
+    name: install & run "${{matrix.command}}" (${{matrix.os}})
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     strategy:

From 4489ca4ca8a0f1b86f35e6d5bd664de5bd6be23f Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 12:41:12 +0100
Subject: [PATCH 045/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/python.yml | 6 +++---
 tox.ini                      | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index df51b5b5..ea0e314e 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -70,9 +70,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - # test with the locked dependencies
+          - # test with the latest dependencies
             python-version: '3.12'
-            toxenv-factor: 'locked'
+            toxenv-factor: 'latest'
             os: ubuntu-latest
           - # test with the lowest dependencies
             python-version: '3.8'
@@ -172,7 +172,7 @@ jobs:
           - "3.10"
           - "3.9"
           - "3.8"  # lowest supported -- handled in include
-        toxenv-factor: ['locked']
+        toxenv-factor: ['latest']
         include:
           # test with the lowest dependencies
           - os: ubuntu-latest
diff --git a/tox.ini b/tox.ini
index 8b55515b..c5c7bfe6 100644
--- a/tox.ini
+++ b/tox.ini
@@ -7,8 +7,8 @@
 minversion = 4.0
 envlist =
     flake8
-    mypy-{locked,lowest}
-    py{311,310,39,38}-{locked,lowest}
+    mypy-{latest,lowest}
+    py{311,310,39,38}-{latest,lowest}
     bandit
 skip_missing_interpreters = True
 usedevelop = False
@@ -27,7 +27,7 @@ commands_pre =
 commands =
     poetry run coverage run --source=cyclonedx_py -m unittest discover -t . -s tests -v
 
-[testenv:mypy{,-locked,-lowest}]
+[testenv:mypy{,-latest,-lowest}]
 skip_install = True
 commands =
     # mypy config is on own file: `.mypy.ini`

From 5b3eac4d2674c9067224a484b3a2843818779d03 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 12:49:12 +0100
Subject: [PATCH 046/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/python.yml | 33 ++++++++++-----------------------
 deps.lowest.r                | 13 -------------
 tox.ini                      |  7 +++----
 3 files changed, 13 insertions(+), 40 deletions(-)
 delete mode 100644 deps.lowest.r

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index ea0e314e..7bfc6d76 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -63,21 +63,19 @@ jobs:
         run: poetry run tox r -e flake8 -s false
 
   static-code-analysis:
-    name: Static Coding Analysis (py${{ matrix.python-version}} ${{ matrix.toxenv-factor }})
+    name: StaticCodingAnalysis (py${{ matrix.python-version}} ${{ matrix.toxenv-factors }})
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix:
         include:
-          - # test with the latest dependencies
-            python-version: '3.12'
-            toxenv-factor: 'latest'
+          - python-version: '3.12'
             os: ubuntu-latest
-          - # test with the lowest dependencies
-            python-version: '3.8'
-            toxenv-factor: 'lowest'
+            toxenv-factors: '-current'
+          - python-version: '3.8'
             os: ubuntu-latest
+            toxenv-factors: '-lowest'
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
@@ -96,7 +94,7 @@ jobs:
       - name: Install dependencies
         run: poetry install --no-root
       - name: Run tox
-        run: poetry run tox r -e mypy-${{ matrix.toxenv-factor }} -s false
+        run: poetry run tox r -e mypy${{ matrix.toxenv-factors }} -s false
 
   security-issues:
     name: find Security Issues
@@ -155,8 +153,9 @@ jobs:
         run: poetry install --no-dev
       - name: run command
         run: poetry run ${{matrix.command}}
+
   build-and-test:
-    name: Test (${{ matrix.os }} py${{ matrix.python-version }} ${{ matrix.toxenv-factor }})
+    name: Test (${{ matrix.os }} py${{ matrix.python-version }})
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     strategy:
@@ -172,18 +171,6 @@ jobs:
           - "3.10"
           - "3.9"
           - "3.8"  # lowest supported -- handled in include
-        toxenv-factor: ['latest']
-        include:
-          # test with the lowest dependencies
-          - os: ubuntu-latest
-            python-version: '3.8'
-            toxenv-factor: 'lowest'
-          - os: macos-latest
-            python-version: '3.8'
-            toxenv-factor: 'lowest'
-          - os: windows-latest
-            python-version: '3.8'
-            toxenv-factor: 'lowest'
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
@@ -206,14 +193,14 @@ jobs:
       - name: Ensure build successful
         run: poetry build
       - name: Run tox
-        run: poetry run tox r -e py-${{ matrix.toxenv-factor }} -s false
+        run: poetry run tox r -e py -s false
       - name: Generate coverage reports
         if: ${{ failure() || success() }}
         shell: bash
         run: |
           set -eux
           poetry run coverage report -m
-          poetry run coverage xml -o '${{ env.REPORTS_DIR }}/coverage/${{ matrix.os }}_${{ matrix.python-version }}_${{ matrix.toxenv-factor }}.cobertura.xml'
+          poetry run coverage xml -o '${{ env.REPORTS_DIR }}/coverage/${{ matrix.os }}_${{ matrix.python-version }}.cobertura.xml'
       - name: Artifact reports
         if: ${{ ! cancelled() }}
         # see https://github.com/actions/upload-artifact
diff --git a/deps.lowest.r b/deps.lowest.r
deleted file mode 100644
index 831825b7..00000000
--- a/deps.lowest.r
+++ /dev/null
@@ -1,13 +0,0 @@
-# exactly pinned dependencies to the lowest version regardless of python_version
-# see pyproject file for ranges
-
-cyclonedx-python-lib[validation] == 5.0.0
-packageurl-python == 0.11.1
-pip-requirements-parser == 32.0.0
-chardet == 5.1.0
-setuptools == 47.0.0
-types-setuptools == 57.0.0
-toml == 0.10.0
-types-toml == 0.10.0
-
-# file name is a untypical one, so dependabot does not bump this file
diff --git a/tox.ini b/tox.ini
index c5c7bfe6..c3ff1b47 100644
--- a/tox.ini
+++ b/tox.ini
@@ -7,8 +7,8 @@
 minversion = 4.0
 envlist =
     flake8
-    mypy-{latest,lowest}
-    py{311,310,39,38}-{latest,lowest}
+    mypy-{current,lowest}
+    py{311,310,39,38}
     bandit
 skip_missing_interpreters = True
 usedevelop = False
@@ -22,12 +22,11 @@ allowlist_externals = poetry
 commands_pre =
     {envpython} --version
     poetry install --no-root -v
-    lowest: poetry run pip install -U -r deps.lowest.r
     poetry run pip freeze
 commands =
     poetry run coverage run --source=cyclonedx_py -m unittest discover -t . -s tests -v
 
-[testenv:mypy{,-latest,-lowest}]
+[testenv:mypy{,-current,-lowest}]
 skip_install = True
 commands =
     # mypy config is on own file: `.mypy.ini`

From 1592483ccc79c960b11c68d48378af4af4a44edf Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 12:57:05 +0100
Subject: [PATCH 047/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/python.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 7bfc6d76..6cc2d705 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -142,7 +142,7 @@ jobs:
         # see https://github.com/actions/setup-python
         uses: actions/setup-python@v4
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
           architecture: 'x64'
       - name: Install poetry
         # see https://github.com/marketplace/actions/setup-poetry

From 486b32c13fa04a83716816ea098c386ed4f6e060 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 13:18:00 +0100
Subject: [PATCH 048/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/pipenv.py       | 5 +++--
 cyclonedx_py/_internal/poetry.py       | 5 +++--
 cyclonedx_py/_internal/requirements.py | 7 ++++---
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index c13ec05f..28a97b5c 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -39,7 +39,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
         p = ArgumentParser(description='Build an SBOM based on PipEnv',
                            **kwargs)
-        p.add_argument('lock-file',
+        p.add_argument('lock',
+                       metavar='lock-file',
                        help='I HELP TODO (default: %(default)s)',
                        nargs=OPTIONAL,
                        type=FileType('rb'),
@@ -52,7 +53,7 @@ def __init__(self, *,
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
-                 infile: BinaryIO,
+                 lock: BinaryIO,
                  **kwargs: Any) -> 'Bom':
         from .utils.bom import make_bom
 
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index b42790dc..8d95fbc7 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -39,7 +39,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
         p = ArgumentParser(description='Build an SBOM based on Poetry environment.',
                            **kwargs)
-        p.add_argument('lock-file',
+        p.add_argument('lock',
+                       metavar='lock-file',
                        help='I HELP TODO (default: %(default)s)',
                        nargs=OPTIONAL,
                        type=FileType('rb'),
@@ -52,7 +53,7 @@ def __init__(self, *,
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
-                 infile: BinaryIO,
+                 lock: BinaryIO,
                  **kwargs: Any) -> 'Bom':
         from .utils.bom import make_bom
 
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 448fd2a5..b377dc1a 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -55,7 +55,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                                      python3 -m pip freeze | %(prog)s -
                            '''),
                            **kwargs)
-        p.add_argument('infile',
+        p.add_argument('requirements',
+                       metavar='requirements-file',
                        help='I HELP TODO (default: %(default)s)',
                        nargs=OPTIONAL,
                        type=FileType('rb'),
@@ -68,14 +69,14 @@ def __init__(self, *,
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
-                 infile: BinaryIO,
+                 requirements: BinaryIO,
                  **kwargs: Any) -> 'Bom':
         from pip_requirements_parser import RequirementsFile
 
         from .utils.io import io2file
 
         # no support for `include_nested` intended, so a temp file instead the original path is fine
-        rf = io2file(infile)
+        rf = io2file(requirements)
         try:
             return self._make_bom(
                 RequirementsFile.from_file(rf, include_nested=False).requirements

From c156ab220aa46a6c38536662c56f5f9f24c9a11b Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 15:46:41 +0100
Subject: [PATCH 049/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py                 |   7 +-
 cyclonedx_py/_internal/requirements.py        |  30 +--
 tests/__init__.py                             |   4 +-
 tests/_data/infiles/requirements/local.txt    |   3 -
 tests/_data/infiles/requirements/nested.txt   |   4 +
 ....0.xml.bin => frozen.txt-1.0.xml-file.bin} |   0
 .../frozen.txt-1.0.xml-stream.bin             |  23 ++
 ....1.xml.bin => frozen.txt-1.1.xml-file.bin} |   0
 .../frozen.txt-1.1.xml-stream.bin             |  21 ++
 ....json.bin => frozen.txt-1.2.json-file.bin} |   0
 .../frozen.txt-1.2.json-stream.bin            |  56 +++++
 ....2.xml.bin => frozen.txt-1.2.xml-file.bin} |   0
 .../frozen.txt-1.2.xml-stream.bin             |  39 ++++
 ....json.bin => frozen.txt-1.3.json-file.bin} |   0
 .../frozen.txt-1.3.json-stream.bin            |  56 +++++
 ....3.xml.bin => frozen.txt-1.3.xml-file.bin} |   0
 .../frozen.txt-1.3.xml-stream.bin             |  39 ++++
 ....json.bin => frozen.txt-1.4.json-file.bin} |   0
 .../frozen.txt-1.4.json-stream.bin            | 124 +++++++++++
 ....4.xml.bin => frozen.txt-1.4.xml-file.bin} |   0
 .../frozen.txt-1.4.xml-stream.bin             |  91 ++++++++
 ...1.0.xml.bin => local.txt-1.0.xml-file.bin} |   6 +-
 .../requirements/local.txt-1.0.xml-stream.bin |  44 ++++
 ...1.1.xml.bin => local.txt-1.1.xml-file.bin} |  12 +-
 .../requirements/local.txt-1.1.xml-stream.bin |  56 +++++
 ...2.json.bin => local.txt-1.2.json-file.bin} |  18 +-
 .../local.txt-1.2.json-stream.bin             | 111 ++++++++++
 ...1.2.xml.bin => local.txt-1.2.xml-file.bin} |  14 +-
 .../requirements/local.txt-1.2.xml-stream.bin |  78 +++++++
 ...3.json.bin => local.txt-1.3.json-file.bin} |  18 +-
 .../local.txt-1.3.json-stream.bin             | 111 ++++++++++
 ...1.3.xml.bin => local.txt-1.3.xml-file.bin} |  14 +-
 .../requirements/local.txt-1.3.xml-stream.bin |  78 +++++++
 ...4.json.bin => local.txt-1.4.json-file.bin} |  18 +-
 .../local.txt-1.4.json-stream.bin             | 174 +++++++++++++++
 ...1.4.xml.bin => local.txt-1.4.xml-file.bin} |  14 +-
 .../requirements/local.txt-1.4.xml-stream.bin | 125 +++++++++++
 .../requirements/nested.txt-1.0.xml-file.bin  |  23 ++
 .../nested.txt-1.0.xml-stream.bin             |   4 +
 .../requirements/nested.txt-1.1.xml-file.bin  |  21 ++
 .../nested.txt-1.1.xml-stream.bin             |   4 +
 .../requirements/nested.txt-1.2.json-file.bin |  56 +++++
 .../nested.txt-1.2.json-stream.bin            |  20 ++
 .../requirements/nested.txt-1.2.xml-file.bin  |  39 ++++
 .../nested.txt-1.2.xml-stream.bin             |  17 ++
 .../requirements/nested.txt-1.3.json-file.bin |  56 +++++
 .../nested.txt-1.3.json-stream.bin            |  20 ++
 .../requirements/nested.txt-1.3.xml-file.bin  |  39 ++++
 .../nested.txt-1.3.xml-stream.bin             |  17 ++
 .../requirements/nested.txt-1.4.json-file.bin | 124 +++++++++++
 .../nested.txt-1.4.json-stream.bin            |  88 ++++++++
 .../requirements/nested.txt-1.4.xml-file.bin  |  91 ++++++++
 .../nested.txt-1.4.xml-stream.bin             |  69 ++++++
 ... => private-packages.txt-1.0.xml-file.bin} |   0
 .../private-packages.txt-1.0.xml-stream.bin   |  12 ++
 ... => private-packages.txt-1.1.xml-file.bin} |   0
 .../private-packages.txt-1.1.xml-stream.bin   |  11 +
 ...=> private-packages.txt-1.2.json-file.bin} |   0
 .../private-packages.txt-1.2.json-stream.bin  |  35 +++
 ... => private-packages.txt-1.2.xml-file.bin} |   0
 .../private-packages.txt-1.2.xml-stream.bin   |  28 +++
 ...=> private-packages.txt-1.3.json-file.bin} |   0
 .../private-packages.txt-1.3.json-stream.bin  |  35 +++
 ... => private-packages.txt-1.3.xml-file.bin} |   0
 .../private-packages.txt-1.3.xml-stream.bin   |  28 +++
 ...=> private-packages.txt-1.4.json-file.bin} |   0
 .../private-packages.txt-1.4.json-stream.bin  | 103 +++++++++
 ... => private-packages.txt-1.4.xml-file.bin} |   0
 .../private-packages.txt-1.4.xml-stream.bin   |  80 +++++++
 ...ssue448.cp1252.txt.bin-1.0.xml-stream.bin} |   0
 ...ssue448.cp1252.txt.bin-1.1.xml-stream.bin} |   0
 ...sue448.cp1252.txt.bin-1.2.json-stream.bin} |   0
 ...ssue448.cp1252.txt.bin-1.2.xml-stream.bin} |   0
 ...sue448.cp1252.txt.bin-1.3.json-stream.bin} |   0
 ...ssue448.cp1252.txt.bin-1.3.xml-stream.bin} |   0
 ...sue448.cp1252.txt.bin-1.4.json-stream.bin} |   0
 ...ssue448.cp1252.txt.bin-1.4.xml-stream.bin} |   0
 ...bin => with-comments.txt-1.0.xml-file.bin} |   0
 .../with-comments.txt-1.0.xml-stream.bin      |  40 ++++
 ...bin => with-comments.txt-1.1.xml-file.bin} |   0
 .../with-comments.txt-1.1.xml-stream.bin      |  35 +++
 ...in => with-comments.txt-1.2.json-file.bin} |   0
 .../with-comments.txt-1.2.json-stream.bin     |  79 +++++++
 ...bin => with-comments.txt-1.2.xml-file.bin} |   0
 .../with-comments.txt-1.2.xml-stream.bin      |  56 +++++
 ...in => with-comments.txt-1.3.json-file.bin} |   0
 .../with-comments.txt-1.3.json-stream.bin     |  79 +++++++
 ...bin => with-comments.txt-1.3.xml-file.bin} |   0
 .../with-comments.txt-1.3.xml-stream.bin      |  56 +++++
 ...in => with-comments.txt-1.4.json-file.bin} |   0
 .../with-comments.txt-1.4.json-stream.bin     | 147 +++++++++++++
 ...bin => with-comments.txt-1.4.xml-file.bin} |   0
 .../with-comments.txt-1.4.xml-stream.bin      | 108 ++++++++++
 ...l.bin => with-hashes.txt-1.0.xml-file.bin} |   0
 .../with-hashes.txt-1.0.xml-stream.bin        |  38 ++++
 ...l.bin => with-hashes.txt-1.1.xml-file.bin} |   0
 .../with-hashes.txt-1.1.xml-stream.bin        |  35 +++
 ....bin => with-hashes.txt-1.2.json-file.bin} |   0
 .../with-hashes.txt-1.2.json-stream.bin       |  87 ++++++++
 ...l.bin => with-hashes.txt-1.2.xml-file.bin} |   0
 .../with-hashes.txt-1.2.xml-stream.bin        |  54 +++++
 ....bin => with-hashes.txt-1.3.json-file.bin} |   0
 .../with-hashes.txt-1.3.json-stream.bin       |  87 ++++++++
 ...l.bin => with-hashes.txt-1.3.xml-file.bin} |   0
 .../with-hashes.txt-1.3.xml-stream.bin        |  54 +++++
 ....bin => with-hashes.txt-1.4.json-file.bin} |   0
 .../with-hashes.txt-1.4.json-stream.bin       | 155 +++++++++++++
 ...l.bin => with-hashes.txt-1.4.xml-file.bin} |   0
 .../with-hashes.txt-1.4.xml-stream.bin        | 106 +++++++++
 ...xml.bin => with-urls.txt-1.0.xml-file.bin} |   0
 .../with-urls.txt-1.0.xml-stream.bin          |  53 +++++
 ...xml.bin => with-urls.txt-1.1.xml-file.bin} |   0
 .../with-urls.txt-1.1.xml-stream.bin          |  81 +++++++
 ...on.bin => with-urls.txt-1.2.json-file.bin} |   0
 .../with-urls.txt-1.2.json-stream.bin         | 142 ++++++++++++
 ...xml.bin => with-urls.txt-1.2.xml-file.bin} |   0
 .../with-urls.txt-1.2.xml-stream.bin          | 104 +++++++++
 ...on.bin => with-urls.txt-1.3.json-file.bin} |   0
 .../with-urls.txt-1.3.json-stream.bin         | 142 ++++++++++++
 ...xml.bin => with-urls.txt-1.3.xml-file.bin} |   0
 .../with-urls.txt-1.3.xml-stream.bin          | 104 +++++++++
 ...on.bin => with-urls.txt-1.4.json-file.bin} |   0
 .../with-urls.txt-1.4.json-stream.bin         | 204 ++++++++++++++++++
 ...xml.bin => with-urls.txt-1.4.xml-file.bin} |   0
 .../with-urls.txt-1.4.xml-stream.bin          | 150 +++++++++++++
 ...hout-pinned-versions.txt-1.0.xml-file.bin} |   0
 ...out-pinned-versions.txt-1.0.xml-stream.bin |  26 +++
 ...hout-pinned-versions.txt-1.1.xml-file.bin} |   0
 ...out-pinned-versions.txt-1.1.xml-stream.bin |  23 ++
 ...out-pinned-versions.txt-1.2.json-file.bin} |   0
 ...ut-pinned-versions.txt-1.2.json-stream.bin |  57 +++++
 ...hout-pinned-versions.txt-1.2.xml-file.bin} |   0
 ...out-pinned-versions.txt-1.2.xml-stream.bin |  42 ++++
 ...out-pinned-versions.txt-1.3.json-file.bin} |   0
 ...ut-pinned-versions.txt-1.3.json-stream.bin |  57 +++++
 ...hout-pinned-versions.txt-1.3.xml-file.bin} |   0
 ...out-pinned-versions.txt-1.3.xml-stream.bin |  42 ++++
 ...out-pinned-versions.txt-1.4.json-file.bin} |   0
 ...ut-pinned-versions.txt-1.4.json-stream.bin | 122 +++++++++++
 ...hout-pinned-versions.txt-1.4.xml-file.bin} |   0
 ...out-pinned-versions.txt-1.4.xml-stream.bin |  91 ++++++++
 tests/integration/test_requirements.py        |  71 +++++-
 142 files changed, 5048 insertions(+), 87 deletions(-)
 create mode 100644 tests/_data/infiles/requirements/nested.txt
 rename tests/_data/snapshots/requirements/{frozen.txt-1.0.xml.bin => frozen.txt-1.0.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin
 rename tests/_data/snapshots/requirements/{frozen.txt-1.1.xml.bin => frozen.txt-1.1.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
 rename tests/_data/snapshots/requirements/{frozen.txt-1.2.json.bin => frozen.txt-1.2.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
 rename tests/_data/snapshots/requirements/{frozen.txt-1.2.xml.bin => frozen.txt-1.2.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
 rename tests/_data/snapshots/requirements/{frozen.txt-1.3.json.bin => frozen.txt-1.3.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
 rename tests/_data/snapshots/requirements/{frozen.txt-1.3.xml.bin => frozen.txt-1.3.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
 rename tests/_data/snapshots/requirements/{frozen.txt-1.4.json.bin => frozen.txt-1.4.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
 rename tests/_data/snapshots/requirements/{frozen.txt-1.4.xml.bin => frozen.txt-1.4.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.0.xml.bin => local.txt-1.0.xml-file.bin} (87%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.1.xml.bin => local.txt-1.1.xml-file.bin} (88%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.2.json.bin => local.txt-1.2.json-file.bin} (92%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.2.xml.bin => local.txt-1.2.xml-file.bin} (89%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.3.json.bin => local.txt-1.3.json-file.bin} (92%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.3.xml.bin => local.txt-1.3.xml-file.bin} (89%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.4.json.bin => local.txt-1.4.json-file.bin} (95%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
 rename tests/_data/snapshots/requirements/{local.txt-1.4.xml.bin => local.txt-1.4.xml-file.bin} (94%)
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.0.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.1.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.0.xml.bin => private-packages.txt-1.0.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.1.xml.bin => private-packages.txt-1.1.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.2.json.bin => private-packages.txt-1.2.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.2.xml.bin => private-packages.txt-1.2.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.3.json.bin => private-packages.txt-1.3.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.3.xml.bin => private-packages.txt-1.3.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.4.json.bin => private-packages.txt-1.4.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.4.xml.bin => private-packages.txt-1.4.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.0.xml.bin => regression-issue448.cp1252.txt.bin-1.0.xml-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.1.xml.bin => regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.2.json.bin => regression-issue448.cp1252.txt.bin-1.2.json-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.2.xml.bin => regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.3.json.bin => regression-issue448.cp1252.txt.bin-1.3.json-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.3.xml.bin => regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.4.json.bin => regression-issue448.cp1252.txt.bin-1.4.json-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.4.xml.bin => regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.0.xml.bin => with-comments.txt-1.0.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.1.xml.bin => with-comments.txt-1.1.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.2.json.bin => with-comments.txt-1.2.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.2.xml.bin => with-comments.txt-1.2.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.3.json.bin => with-comments.txt-1.3.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.3.xml.bin => with-comments.txt-1.3.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.4.json.bin => with-comments.txt-1.4.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.4.xml.bin => with-comments.txt-1.4.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.0.xml.bin => with-hashes.txt-1.0.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.1.xml.bin => with-hashes.txt-1.1.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.2.json.bin => with-hashes.txt-1.2.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.2.xml.bin => with-hashes.txt-1.2.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.3.json.bin => with-hashes.txt-1.3.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.3.xml.bin => with-hashes.txt-1.3.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.4.json.bin => with-hashes.txt-1.4.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.4.xml.bin => with-hashes.txt-1.4.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.0.xml.bin => with-urls.txt-1.0.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.1.xml.bin => with-urls.txt-1.1.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.2.json.bin => with-urls.txt-1.2.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.2.xml.bin => with-urls.txt-1.2.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.3.json.bin => with-urls.txt-1.3.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.3.xml.bin => with-urls.txt-1.3.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.4.json.bin => with-urls.txt-1.4.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.4.xml.bin => with-urls.txt-1.4.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.0.xml.bin => without-pinned-versions.txt-1.0.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.1.xml.bin => without-pinned-versions.txt-1.1.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.2.json.bin => without-pinned-versions.txt-1.2.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.2.xml.bin => without-pinned-versions.txt-1.2.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.3.json.bin => without-pinned-versions.txt-1.3.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.3.xml.bin => without-pinned-versions.txt-1.3.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.4.json.bin => without-pinned-versions.txt-1.4.json-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.4.xml.bin => without-pinned-versions.txt-1.4.xml-file.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 12dd589e..57bf74a6 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -218,7 +218,7 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
     logger.propagate = False
     logger.setLevel(ll)
     logger.addHandler(lh)
-    del lh, ll
+    del ll
     logger.debug('args: %s', args)
 
     try:
@@ -227,4 +227,7 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
         logger.debug('Error: %s', error, exc_info=error)
         logger.critical(f'{error}')
         return 1
-    return 0
+    else:
+        return 0
+    finally:
+        logger.removeHandler(lh)
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index b377dc1a..f461719b 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -17,7 +17,7 @@
 
 
 from os import unlink
-from typing import TYPE_CHECKING, Any, BinaryIO, Iterable
+from typing import TYPE_CHECKING, Any, Iterable
 
 from . import BomBuilder
 
@@ -38,7 +38,7 @@ class RequirementsBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser, FileType
+        from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
         p = ArgumentParser(description='Build an SBOM from frozen requirements.',
@@ -55,11 +55,10 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                                      python3 -m pip freeze | %(prog)s -
                            '''),
                            **kwargs)
-        p.add_argument('requirements',
+        p.add_argument('requirements_file',
                        metavar='requirements-file',
                        help='I HELP TODO (default: %(default)s)',
                        nargs=OPTIONAL,
-                       type=FileType('rb'),
                        default='requirements.txt')
         return p
 
@@ -69,20 +68,23 @@ def __init__(self, *,
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
-                 requirements: BinaryIO,
+                 requirements_file: str,
                  **kwargs: Any) -> 'Bom':
         from pip_requirements_parser import RequirementsFile
 
-        from .utils.io import io2file
+        if requirements_file == '-':
+            from sys import stdin
 
-        # no support for `include_nested` intended, so a temp file instead the original path is fine
-        rf = io2file(requirements)
-        try:
-            return self._make_bom(
-                RequirementsFile.from_file(rf, include_nested=False).requirements
-            )
-        finally:
-            unlink(rf)
+            from .utils.io import io2file
+            rf = io2file(stdin.buffer)
+            try:
+                rs = RequirementsFile.from_file(rf, include_nested=False).requirements
+            finally:
+                unlink(rf)
+        else:
+            rs = RequirementsFile.from_file(requirements_file, include_nested=True).requirements
+
+        return self._make_bom(rs)
 
     def _make_bom(self, requirements: Iterable['InstallRequirement']) -> 'Bom':
         from .utils.bom import make_bom
diff --git a/tests/__init__.py b/tests/__init__.py
index 43411567..21e94c47 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -14,6 +14,8 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
 import re
 from json import dumps as json_dumps
 from os import getenv
@@ -30,7 +32,7 @@
 INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
 SNAPSHOTS_DIRECTORY = join(_TESTDATA_DIRECTORY, 'snapshots')
 
-RECREATE_SNAPSHOTS = '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
+RECREATE_SNAPSHOTS = True or '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
 if RECREATE_SNAPSHOTS:
     print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
 
diff --git a/tests/_data/infiles/requirements/local.txt b/tests/_data/infiles/requirements/local.txt
index de7d7fee..4c55d2e3 100644
--- a/tests/_data/infiles/requirements/local.txt
+++ b/tests/_data/infiles/requirements/local.txt
@@ -7,9 +7,6 @@
 # editable install
 -e ./myproject/idna.whl
 
-# nested file -- expected to be ignored
--r requirements-nested.txt
-
 # named
 foo @ file://../foo
 
diff --git a/tests/_data/infiles/requirements/nested.txt b/tests/_data/infiles/requirements/nested.txt
new file mode 100644
index 00000000..a55928fc
--- /dev/null
+++ b/tests/_data/infiles/requirements/nested.txt
@@ -0,0 +1,4 @@
+# nest another requirement file in
+
+-r frozen.txt
+
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..fd1aada5
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..78bd8599
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..bd63a80d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
@@ -0,0 +1,56 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..1998d749
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
@@ -0,0 +1,39 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..090fcd79
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
@@ -0,0 +1,56 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..0cc5a698
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
@@ -0,0 +1,39 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..7f64bc62
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
@@ -0,0 +1,124 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..2600777f
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
@@ -0,0 +1,91 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin
similarity index 87%
rename from tests/_data/snapshots/requirements/local.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin
index d3d94c13..981a9215 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.0.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin
@@ -4,13 +4,13 @@
     <component type="library">
       <name>foo</name>
       <version/>
-      <description>requirements line 14: foo @ file://../foo</description>
+      <description>requirements line 11: foo @ file://../foo</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>numpy</name>
       <version>1.9.2</version>
-      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <modified>false</modified>
     </component>
     <component type="library">
@@ -37,7 +37,7 @@
     <component type="library">
       <name>unknown</name>
       <version/>
-      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..981a9215
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin
@@ -0,0 +1,44 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>foo</name>
+      <version/>
+      <description>requirements line 11: foo @ file://../foo</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 2: ./myproject/chardet</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
similarity index 88%
rename from tests/_data/snapshots/requirements/local.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
index 8cb425e1..5c9134b4 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.1.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
@@ -1,15 +1,15 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L11">
       <name>foo</name>
       <version/>
-      <description>requirements line 14: foo @ file://../foo</description>
+      <description>requirements line 11: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
       <version>1.9.2</version>
-      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
@@ -41,10 +41,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L20">
+    <component type="library" bom-ref="requirements-L17">
       <name>unknown</name>
       <version/>
-      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..5c9134b4
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
@@ -0,0 +1,56 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>foo</name>
+      <version/>
+      <description>requirements line 11: foo @ file://../foo</description>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 2: ./myproject/chardet</description>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
similarity index 92%
rename from tests/_data/snapshots/requirements/local.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
index 8ed5a758..68e5895b 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
@@ -1,15 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: foo @ file://../foo",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
       "name": "foo",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
           "comment": "local path to wheel/archive",
@@ -56,8 +56,8 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L20",
-      "description": "requirements line 20: ./downloads/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
           "comment": "local path to wheel/archive",
@@ -71,6 +71,9 @@
     }
   ],
   "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
     {
       "ref": "requirements-L14"
     },
@@ -80,9 +83,6 @@
     {
       "ref": "requirements-L2"
     },
-    {
-      "ref": "requirements-L20"
-    },
     {
       "ref": "requirements-L5"
     },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..68e5895b
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
@@ -0,0 +1,111 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
+      "name": "foo",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
similarity index 89%
rename from tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
index 5fb85d17..45188bb8 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
@@ -15,15 +15,15 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L11">
       <name>foo</name>
       <version/>
-      <description>requirements line 14: foo @ file://../foo</description>
+      <description>requirements line 11: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
       <version>1.9.2</version>
-      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
@@ -55,10 +55,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L20">
+    <component type="library" bom-ref="requirements-L17">
       <name>unknown</name>
       <version/>
-      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
@@ -68,10 +68,10 @@
     </component>
   </components>
   <dependencies>
+    <dependency ref="requirements-L11"/>
     <dependency ref="requirements-L14"/>
     <dependency ref="requirements-L17"/>
     <dependency ref="requirements-L2"/>
-    <dependency ref="requirements-L20"/>
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L8"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..45188bb8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>foo</name>
+      <version/>
+      <description>requirements line 11: foo @ file://../foo</description>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 2: ./myproject/chardet</description>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
similarity index 92%
rename from tests/_data/snapshots/requirements/local.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
index 759c0d0d..1ba7a159 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
@@ -1,15 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: foo @ file://../foo",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
       "name": "foo",
       "type": "library",
       "version": ""
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
           "comment": "local path to wheel/archive",
@@ -56,8 +56,8 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L20",
-      "description": "requirements line 20: ./downloads/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
           "comment": "local path to wheel/archive",
@@ -71,6 +71,9 @@
     }
   ],
   "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
     {
       "ref": "requirements-L14"
     },
@@ -80,9 +83,6 @@
     {
       "ref": "requirements-L2"
     },
-    {
-      "ref": "requirements-L20"
-    },
     {
       "ref": "requirements-L5"
     },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..1ba7a159
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
@@ -0,0 +1,111 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
+      "name": "foo",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
similarity index 89%
rename from tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
index c7bd67b3..42b9482b 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
@@ -15,15 +15,15 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L11">
       <name>foo</name>
       <version/>
-      <description>requirements line 14: foo @ file://../foo</description>
+      <description>requirements line 11: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
       <version>1.9.2</version>
-      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
@@ -55,10 +55,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L20">
+    <component type="library" bom-ref="requirements-L17">
       <name>unknown</name>
       <version/>
-      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
@@ -68,10 +68,10 @@
     </component>
   </components>
   <dependencies>
+    <dependency ref="requirements-L11"/>
     <dependency ref="requirements-L14"/>
     <dependency ref="requirements-L17"/>
     <dependency ref="requirements-L2"/>
-    <dependency ref="requirements-L20"/>
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L8"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..42b9482b
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>foo</name>
+      <version/>
+      <description>requirements line 11: foo @ file://../foo</description>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 2: ./myproject/chardet</description>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
similarity index 95%
rename from tests/_data/snapshots/requirements/local.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
index c281e075..61e58c40 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
@@ -1,14 +1,14 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: foo @ file://../foo",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
       "name": "foo",
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
           "comment": "local path to wheel/archive",
@@ -52,8 +52,8 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L20",
-      "description": "requirements line 20: ./downloads/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
           "comment": "local path to wheel/archive",
@@ -66,6 +66,9 @@
     }
   ],
   "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
     {
       "ref": "requirements-L14"
     },
@@ -75,9 +78,6 @@
     {
       "ref": "requirements-L2"
     },
-    {
-      "ref": "requirements-L20"
-    },
     {
       "ref": "requirements-L5"
     },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..61e58c40
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
@@ -0,0 +1,174 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
+      "name": "foo",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "local path to wheel/archive",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
similarity index 94%
rename from tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
index e2f4ba4f..7a0a6310 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
@@ -67,14 +67,14 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L11">
       <name>foo</name>
-      <description>requirements line 14: foo @ file://../foo</description>
+      <description>requirements line 11: foo @ file://../foo</description>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
       <version>1.9.2</version>
-      <description>requirements line 17: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
@@ -103,9 +103,9 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L20">
+    <component type="library" bom-ref="requirements-L17">
       <name>unknown</name>
-      <description>requirements line 20: ./downloads/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
@@ -115,10 +115,10 @@
     </component>
   </components>
   <dependencies>
+    <dependency ref="requirements-L11"/>
     <dependency ref="requirements-L14"/>
     <dependency ref="requirements-L17"/>
     <dependency ref="requirements-L2"/>
-    <dependency ref="requirements-L20"/>
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L8"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..7a0a6310
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
@@ -0,0 +1,125 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>foo</name>
+      <description>requirements line 11: foo @ file://../foo</description>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>unknown</name>
+      <description>requirements line 2: ./myproject/chardet</description>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>unknown</name>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
+      <hashes>
+        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+      </hashes>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>local path to wheel/archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin
new file mode 100644
index 00000000..fd1aada5
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.0.xml-stream.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
new file mode 100644
index 00000000..78bd8599
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-stream.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
new file mode 100644
index 00000000..bd63a80d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
@@ -0,0 +1,56 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..6dcf4e3f
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
@@ -0,0 +1,20 @@
+{
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
new file mode 100644
index 00000000..1998d749
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
@@ -0,0 +1,39 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..d91fc191
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
new file mode 100644
index 00000000..090fcd79
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
@@ -0,0 +1,56 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..ae6bb18c
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
@@ -0,0 +1,20 @@
+{
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
new file mode 100644
index 00000000..0cc5a698
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
@@ -0,0 +1,39 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..77546d46
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
new file mode 100644
index 00000000..7f64bc62
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
@@ -0,0 +1,124 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..ec7c189e
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin
@@ -0,0 +1,88 @@
+{
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
new file mode 100644
index 00000000..2600777f
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
@@ -0,0 +1,91 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..50420a76
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin
@@ -0,0 +1,69 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+</bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..cf416381
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..c83955b8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
@@ -0,0 +1,11 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..f5d6a652
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
@@ -0,0 +1,35 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: mypackage==1.2.3",
+      "name": "mypackage",
+      "purl": "pkg:pypi/mypackage@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..683f061f
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..7cdf7a7b
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
@@ -0,0 +1,35 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: mypackage==1.2.3",
+      "name": "mypackage",
+      "purl": "pkg:pypi/mypackage@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..4d3c858d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..c9db4270
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
@@ -0,0 +1,103 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: mypackage==1.2.3",
+      "name": "mypackage",
+      "purl": "pkg:pypi/mypackage@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..b44ab092
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
@@ -0,0 +1,80 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>mypackage</name>
+      <version>1.2.3</version>
+      <description>requirements line 3: mypackage==1.2.3</description>
+      <purl>pkg:pypi/mypackage@1.2.3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-stream.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml.bin
rename to tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..8302ef11
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-stream.bin
@@ -0,0 +1,40 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
+      <purl>pkg:pypi/idna@2.10</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..e173155c
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin
@@ -0,0 +1,35 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>idna</name>
+      <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..d9242efa
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
@@ -0,0 +1,79 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L5"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..a979ffbd
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
@@ -0,0 +1,56 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>idna</name>
+      <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..d3d21335
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
@@ -0,0 +1,79 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L5"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..85a94338
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
@@ -0,0 +1,56 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>idna</name>
+      <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..371c0d09
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
@@ -0,0 +1,147 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L5"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..6914da3d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
@@ -0,0 +1,108 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>idna</name>
+      <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
+      <purl>pkg:pypi/idna@2.10</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..6a66d014
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..c799a12b
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
@@ -0,0 +1,35 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..05e7b1e7
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
@@ -0,0 +1,87 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..8d293dc5
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..eb0a11e0
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
@@ -0,0 +1,87 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..c057f665
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..af89579e
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
@@ -0,0 +1,155 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+        },
+        {
+          "alg": "SHA-256",
+          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..cd03b415
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <hashes>
+        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+      </hashes>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
+      <hashes>
+        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+      </hashes>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
+      <hashes>
+        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+      </hashes>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..297d7b08
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>package-four</name>
+      <version/>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-one</name>
+      <version/>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-three</name>
+      <version/>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-two</name>
+      <version/>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..75846370
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin
@@ -0,0 +1,81 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L10">
+      <name>package-four</name>
+      <version/>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>package-one</name>
+      <version/>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>package-three</name>
+      <version/>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L6">
+      <name>package-two</name>
+      <version/>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..abd9595a
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
@@ -0,0 +1,142 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L10",
+      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L10"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L21"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..698925ee
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
@@ -0,0 +1,104 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L10">
+      <name>package-four</name>
+      <version/>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>package-one</name>
+      <version/>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>package-three</name>
+      <version/>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L6">
+      <name>package-two</name>
+      <version/>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L10"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..e628b8c8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
@@ -0,0 +1,142 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L10",
+      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L10"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L21"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..993b81bf
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
@@ -0,0 +1,104 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L10">
+      <name>package-four</name>
+      <version/>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>package-one</name>
+      <version/>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>package-three</name>
+      <version/>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L6">
+      <name>package-two</name>
+      <version/>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <version/>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L10"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..b4a63e94
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
@@ -0,0 +1,204 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L10",
+      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L10"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L21"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..d7dbae3d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
@@ -0,0 +1,150 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L10">
+      <name>package-four</name>
+      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>package-one</name>
+      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>package-three</name>
+      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L6">
+      <name>package-two</name>
+      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>urllib3</name>
+      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L10"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..2c1666d8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-stream.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>certifi</name>
+      <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
+      <purl>pkg:pypi/certifi</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>chardet</name>
+      <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
+      <purl>pkg:pypi/chardet</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 3: urllib3</description>
+      <purl>pkg:pypi/urllib3</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..af722b57
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 3: urllib3</description>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..1d6ec9a1
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
@@ -0,0 +1,57 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..0bec9815
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
@@ -0,0 +1,42 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 3: urllib3</description>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..75435150
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
@@ -0,0 +1,57 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..442097d1
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
@@ -0,0 +1,42 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version/>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version/>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>urllib3</name>
+      <version/>
+      <description>requirements line 3: urllib3</description>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..afd6152e
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
@@ -0,0 +1,122 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml.bin
rename to tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..7db3dac2
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
@@ -0,0 +1,91 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
+      <purl>pkg:pypi/certifi</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
+      <purl>pkg:pypi/chardet</purl>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>urllib3</name>
+      <description>requirements line 3: urllib3</description>
+      <purl>pkg:pypi/urllib3</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index b3487ca8..1d26c76a 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -16,11 +16,14 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+import os
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob
-from io import StringIO
+from io import StringIO, TextIOWrapper
 from os.path import basename, join
+from typing import Any, Tuple
 from unittest import TestCase
+from unittest.mock import patch
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
 from ddt import ddt, named_data
@@ -34,18 +37,45 @@
     (OutputFormat.JSON, SchemaVersion.V1_0),
 ]
 
+test_data = [
+    (f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of)
+    for infile in infiles
+    for sv in SchemaVersion
+    for of in OutputFormat
+    if (of, sv) not in unsupported_of_sf
+]
+
+if os.name == 'nt':
+    def test_data_os_filter(data: Any) -> bool:
+        return True
+else:
+    def test_data_os_filter(data: Tuple[Any, str, Any, Any]) -> bool:
+        # skip windows encoded files on non-windows
+        return '.cp125' not in data[1]
+
 
 @ddt
 class TestRequirements(TestCase, SnapshotMixin):
 
-    @named_data(*(
-        [f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of]
-        for infile in infiles
-        for sv in SchemaVersion
-        for of in OutputFormat
-        if (of, sv) not in unsupported_of_sf
-    ))
-    def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_cli_with_file_not_found(self) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'requirements',
+                    '-vvv',
+                    f'--sv={SchemaVersion.V1_4.to_version()}',
+                    f'--of={OutputFormat.XML.name}',
+                    '--outfile=-',
+                    'something-that-must-not-exist.testing'])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn("No such file or directory: 'something-that-must-not-exist.testing'", err)
+
+    @named_data(*filter(test_data_os_filter, test_data))
+    def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -62,7 +92,28 @@ def test_cli_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat)
         self.assertEqual(0, res, err)
         self.assertEqualSnapshot(
             make_comparable(out, of),
-            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}')
+            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}-file')
+
+    @named_data(*test_data)
+    def test_cli_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out, open(infile, 'rb') as inp:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                with patch('sys.stdin', TextIOWrapper(inp)):
+                    res = run_cli(argv=[
+                        'requirements',
+                        '-vvv',
+                        f'--sv={sv.to_version()}',
+                        f'--of={of.name}',
+                        '--outfile=-',
+                        '-'])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}-stream')
 
     def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
         super().assertEqualSnapshot(actual, join('requirements', snapshot_name))

From d7b1ce2b5551422dcd5c01f8fd6dc0c806c64b8a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 15:47:51 +0100
Subject: [PATCH 050/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/snapshots/.gitattributes | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/_data/snapshots/.gitattributes b/tests/_data/snapshots/.gitattributes
index b93c5366..932f6997 100644
--- a/tests/_data/snapshots/.gitattributes
+++ b/tests/_data/snapshots/.gitattributes
@@ -1,4 +1,4 @@
 # files are compared bype-wise, so they need to be treated as binary
 *.bin       linguist-generated binary
-*.xml.bin   linguist-generated binary diff=xml
-*.json.bin  linguist-generated binary diff=json
+*.xml*.bin   linguist-generated binary diff=xml
+*.json*.bin  linguist-generated binary diff=json

From 96cc3b57a4814b6dade3d02cb4e4bd05b2fa2c39 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 16:01:39 +0100
Subject: [PATCH 051/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py        | 22 +++++++++----------
 .../infiles/requirements/private-packages.txt |  3 +++
 tests/integration/test_requirements.py        |  6 ++---
 3 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index f461719b..54b8dedd 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -27,7 +27,7 @@
 
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component
-    from pip_requirements_parser import InstallRequirement  # type:ignore[import-untyped]
+    from pip_requirements_parser import InstallRequirement, RequirementsFile  # type:ignore[import-untyped]
 
 
 # !!! be as lazy loading as possible, as greedy as needed
@@ -76,31 +76,31 @@ def __call__(self, *,  # type:ignore[override]
             from sys import stdin
 
             from .utils.io import io2file
-            rf = io2file(stdin.buffer)
+            rt = io2file(stdin.buffer)
             try:
-                rs = RequirementsFile.from_file(rf, include_nested=False).requirements
+                rf = RequirementsFile.from_file(rf, include_nested=False)
             finally:
-                unlink(rf)
+                unlink(rt)
         else:
-            rs = RequirementsFile.from_file(requirements_file, include_nested=True).requirements
+            rf = RequirementsFile.from_file(requirements_file, include_nested=True)
 
-        return self._make_bom(rs)
+        return self._make_bom(rf)
 
-    def _make_bom(self, requirements: Iterable['InstallRequirement']) -> 'Bom':
+    def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
         from .utils.bom import make_bom
 
         bom = make_bom()
 
-        for requirement in requirements:
-            component = self.__make_component(requirement)
+        for requirement in rf.requirements:
+            component = self._make_component(requirement)
             self._logger.debug('Add component: %r', component)
             if not component.version:
-                self._logger.warning('Component has no version: %r', component)
+                self._logger.warning('Component has no pinned version: %r', component)
             bom.components.add(component)
 
         return bom
 
-    def __make_component(self, req: 'InstallRequirement') -> 'Component':
+    def _make_component(self, req: 'InstallRequirement') -> 'Component':
         from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
         from cyclonedx.model.component import Component, ComponentType
diff --git a/tests/_data/infiles/requirements/private-packages.txt b/tests/_data/infiles/requirements/private-packages.txt
index dca55ced..fd112891 100644
--- a/tests/_data/infiles/requirements/private-packages.txt
+++ b/tests/_data/infiles/requirements/private-packages.txt
@@ -1,3 +1,6 @@
+## pip option to use an alternative package registry
+## !!!! not implemented, yet -- should reflect this in the PURL and other places.
+
 --extra-index-url https://mypi.org/simple/
 
 mypackage==1.2.3
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 1d26c76a..4428cff8 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -40,9 +40,9 @@
 test_data = [
     (f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of)
     for infile in infiles
-    for sv in SchemaVersion
-    for of in OutputFormat
-    if (of, sv) not in unsupported_of_sf
+    for sv in [SchemaVersion.V1_4]
+    for of in [OutputFormat.JSON]
+    if (of, sv) not in unsupported_of_sf and 'private' in infile
 ]
 
 if os.name == 'nt':

From 13e963cfc65725a8bcf20dc88e602c6292554c8d Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 16:04:57 +0100
Subject: [PATCH 052/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/__init__.py                      | 2 +-
 tests/integration/test_requirements.py | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/__init__.py b/tests/__init__.py
index 21e94c47..5534bfb7 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -32,7 +32,7 @@
 INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
 SNAPSHOTS_DIRECTORY = join(_TESTDATA_DIRECTORY, 'snapshots')
 
-RECREATE_SNAPSHOTS = True or '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
+RECREATE_SNAPSHOTS = '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
 if RECREATE_SNAPSHOTS:
     print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
 
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 4428cff8..1d26c76a 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -40,9 +40,9 @@
 test_data = [
     (f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of)
     for infile in infiles
-    for sv in [SchemaVersion.V1_4]
-    for of in [OutputFormat.JSON]
-    if (of, sv) not in unsupported_of_sf and 'private' in infile
+    for sv in SchemaVersion
+    for of in OutputFormat
+    if (of, sv) not in unsupported_of_sf
 ]
 
 if os.name == 'nt':

From 43d8d4f7ef50efd7e47d345e06658d71e118a970 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 16:14:43 +0100
Subject: [PATCH 053/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py                      | 2 +-
 .../requirements/private-packages.txt-1.0.xml-file.bin      | 2 +-
 .../requirements/private-packages.txt-1.0.xml-stream.bin    | 2 +-
 .../requirements/private-packages.txt-1.1.xml-file.bin      | 4 ++--
 .../requirements/private-packages.txt-1.1.xml-stream.bin    | 4 ++--
 .../requirements/private-packages.txt-1.2.json-file.bin     | 6 +++---
 .../requirements/private-packages.txt-1.2.json-stream.bin   | 6 +++---
 .../requirements/private-packages.txt-1.2.xml-file.bin      | 6 +++---
 .../requirements/private-packages.txt-1.2.xml-stream.bin    | 6 +++---
 .../requirements/private-packages.txt-1.3.json-file.bin     | 6 +++---
 .../requirements/private-packages.txt-1.3.json-stream.bin   | 6 +++---
 .../requirements/private-packages.txt-1.3.xml-file.bin      | 6 +++---
 .../requirements/private-packages.txt-1.3.xml-stream.bin    | 6 +++---
 .../requirements/private-packages.txt-1.4.json-file.bin     | 6 +++---
 .../requirements/private-packages.txt-1.4.json-stream.bin   | 6 +++---
 .../requirements/private-packages.txt-1.4.xml-file.bin      | 6 +++---
 .../requirements/private-packages.txt-1.4.xml-stream.bin    | 6 +++---
 17 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 54b8dedd..5007c07c 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -78,7 +78,7 @@ def __call__(self, *,  # type:ignore[override]
             from .utils.io import io2file
             rt = io2file(stdin.buffer)
             try:
-                rf = RequirementsFile.from_file(rf, include_nested=False)
+                rf = RequirementsFile.from_file(rt, include_nested=False)
             finally:
                 unlink(rt)
         else:
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
index cf416381..1f478bb2 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
@@ -4,7 +4,7 @@
     <component type="library">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
index cf416381..1f478bb2 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
@@ -4,7 +4,7 @@
     <component type="library">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
index c83955b8..8876784b 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
@@ -1,10 +1,10 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
index c83955b8..8876784b 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
@@ -1,10 +1,10 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
index f5d6a652..609fd228 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
@@ -1,8 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L3",
-      "description": "requirements line 3: mypackage==1.2.3",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L3"
+      "ref": "requirements-L6"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
index f5d6a652..609fd228 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
@@ -1,8 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L3",
-      "description": "requirements line 3: mypackage==1.2.3",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L3"
+      "ref": "requirements-L6"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
index 683f061f..4bff9102 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
@@ -15,14 +15,14 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L6"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
index 683f061f..4bff9102 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
@@ -15,14 +15,14 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L6"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
index 7cdf7a7b..d92b8a7d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
@@ -1,8 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L3",
-      "description": "requirements line 3: mypackage==1.2.3",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L3"
+      "ref": "requirements-L6"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
index 7cdf7a7b..d92b8a7d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
@@ -1,8 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L3",
-      "description": "requirements line 3: mypackage==1.2.3",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L3"
+      "ref": "requirements-L6"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
index 4d3c858d..68220a35 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
@@ -15,14 +15,14 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L6"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
index 4d3c858d..68220a35 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
@@ -15,14 +15,14 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L6"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
index c9db4270..60182803 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
@@ -1,8 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L3",
-      "description": "requirements line 3: mypackage==1.2.3",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L3"
+      "ref": "requirements-L6"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
index c9db4270..60182803 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
@@ -1,8 +1,8 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L3",
-      "description": "requirements line 3: mypackage==1.2.3",
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: mypackage==1.2.3",
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +11,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L3"
+      "ref": "requirements-L6"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
index b44ab092..33ccf416 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
@@ -67,14 +67,14 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L6"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
index b44ab092..33ccf416 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
@@ -67,14 +67,14 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L3">
+    <component type="library" bom-ref="requirements-L6">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 3: mypackage==1.2.3</description>
+      <description>requirements line 6: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L6"/>
   </dependencies>
 </bom>

From 1ca9f18dd0d436376905b9fe428e6d4abe98e910 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 3 Nov 2023 19:16:19 +0100
Subject: [PATCH 054/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 5007c07c..7e0b21dc 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -17,7 +17,7 @@
 
 
 from os import unlink
-from typing import TYPE_CHECKING, Any, Iterable
+from typing import TYPE_CHECKING, Any
 
 from . import BomBuilder
 

From c3c90df1ffa11ea1d8050e8d6d21eb5a76f73d68 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 4 Nov 2023 11:31:48 +0100
Subject: [PATCH 055/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              |  95 ++-
 cyclonedx_py/_internal/requirements.py        |   1 +
 pyproject.toml                                |  44 +-
 .../infiles/poetry/group-deps-1.1-poetry.lock | 116 ++++
 .../infiles/poetry/group-deps-2.0-poetry.lock | 108 ++++
 .../infiles/poetry/group-deps-pyproject.toml  |  27 +
 .../poetry/lock-regression-issue611.txt.bin   |  17 +
 .../infiles/poetry/more-deps-1.0-poetry.lock  | 185 ++++++
 .../infiles/poetry/more-deps-1.1-poetry.lock  | 349 +++++++++++
 .../infiles/poetry/more-deps-2.0-poetry.lock  | 570 ++++++++++++++++++
 .../infiles/poetry/more-deps-pyproject.toml   |  17 +
 .../infiles/poetry/simple-1.0-poetry.lock     |  30 +
 .../infiles/poetry/simple-1.1-poetry.lock     |  30 +
 .../infiles/poetry/simple-2.0-poetry.lock     |  30 +
 .../infiles/poetry/simple-pyproject.toml      |  17 +
 15 files changed, 1606 insertions(+), 30 deletions(-)
 create mode 100644 tests/_data/infiles/poetry/group-deps-1.1-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/group-deps-2.0-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/group-deps-pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/lock-regression-issue611.txt.bin
 create mode 100644 tests/_data/infiles/poetry/more-deps-1.0-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/more-deps-1.1-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/more-deps-2.0-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/more-deps-pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/simple-1.0-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/simple-1.1-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/simple-2.0-poetry.lock
 create mode 100644 tests/_data/infiles/poetry/simple-pyproject.toml

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 8d95fbc7..12f340f6 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,7 +16,8 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, BinaryIO
+from enum import Enum
+from typing import TYPE_CHECKING, Any, TextIO, Tuple, Generator, List, Dict
 
 from . import BomBuilder
 
@@ -24,26 +25,31 @@
     from argparse import ArgumentParser
     from logging import Logger
 
+    from cyclonedx.model import HashType
     from cyclonedx.model.bom import Bom
+    from cyclonedx.model.component import Component
 
 
 # !!! be as lazy loading as possible, as greedy as needed
 # TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
 
 
+class _CdxProperty(Enum):
+    PackageGroup = 'cdx:poetry:package:group'
+
+
 class PoetryBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser, FileType
+        from argparse import OPTIONAL, ArgumentParser
 
         p = ArgumentParser(description='Build an SBOM based on Poetry environment.',
                            **kwargs)
-        p.add_argument('lock',
+        p.add_argument('lock_file',
                        metavar='lock-file',
                        help='I HELP TODO (default: %(default)s)',
                        nargs=OPTIONAL,
-                       type=FileType('rb'),
                        default='poetry.lock')
         return p
 
@@ -53,11 +59,84 @@ def __init__(self, *,
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
-                 lock: BinaryIO,
+                 lock_file: str,
                  **kwargs: Any) -> 'Bom':
-        from .utils.bom import make_bom
 
-        bom = make_bom()
-        # TODO
+        try:
+            #
+            lock = open(lock_file, 'rt', errors='replace')
+        except OSError as err:
+            raise ValueError(f"can't open {lock_file!r}: {err}")
+
+        with lock:
+            return self._make_bom(lock)
+
+    def _make_bom(self, lock: TextIO) -> 'Bom':
+        import sys
+
+        if sys.version_info < (3, 11):
+            from toml import loads as toml_loads
+        else:
+            from tomllib import loads as toml_loads
+
+        locker = toml_loads(lock.read())
+        lock_version = self.__get_lock_version(locker)
+        self._logger.debug('lock_version: %r', lock_version)
+
+        if lock_version >= (2, 0):
+            return self._make_bom_v2(locker)
+        return self._make_bom_v1(locker)
+
+    @staticmethod
+    def __get_lock_version(locker: Dict[str, Any]) -> Tuple[int, ...]:
+        # no version defined -- assume 1.0
+        return tuple(int(v) for v in locker.get['metadata'].get('lock-version', '1.0').split('.'))
+
+    def __hashes4file(self, files: List[Dict[str, Any]]) -> Generator['HashType', None, None]:
+        from cyclonedx.model import HashType, UnknownHashTypeException
+        for file in files:
+            if 'hash' in file:
+                try:
+                    yield HashType.from_composite_str(file['hash'])
+                except UnknownHashTypeException:
+                    pass
+
+    def __make_component(self, package: dict, files: List[Dict[str, Any]] = None) -> 'Component':
+        from cyclonedx.model.component import Component, ComponentScope
+        from cyclonedx.model import Property
+
+        return Component(
+            name=package['name'],
+            version=package.get('version'),
+            description=package.get('description'),
+            scope=ComponentScope.OPTIONAL if package.get('optional') else None,
+            properties=[
+                Property(  # for backwards compatibility: category -> group
+                    name=_CdxProperty.PackageGroup.value,
+                    value=package['category']
+                ) if 'category' in package else None
+                # TODO actual groups -- from `pyproject.toml`
+            ],
+            hashes=self.__hashes4file(files or package.get('files', []))
+        )
+
+    def _make_bom_v1(self, lock: Dict[str, Any]) -> 'Bom':
+        from cyclonedx.model.bom import Bom
+
+        metavar_files = lock.get('metavar', {}).get('files', {})
+
+        bom = Bom()
+
+        components: Dict[str, Component] = {}
+
+        for package in lock.get('package', []):
+            component = self.__make_component(package, metavar_files.get(package['name'], []))
+            bom.components.add(component)
+            components[component.name] = component
+
+        # TODO dependency tree
 
         return bom
+
+    def _make_bom_v2(self, lock: Dict[str, Any]) -> 'Bom':
+        pass
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 7e0b21dc..87b15d92 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -76,6 +76,7 @@ def __call__(self, *,  # type:ignore[override]
             from sys import stdin
 
             from .utils.io import io2file
+
             rt = io2file(stdin.buffer)
             try:
                 rf = RequirementsFile.from_file(rt, include_nested=False)
diff --git a/pyproject.toml b/pyproject.toml
index ac2fabf6..6b17fb96 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -16,39 +16,39 @@ homepage = "https://github.com/CycloneDX/cyclonedx-python/#readme"
 repository = "https://github.com/CycloneDX/cyclonedx-python"
 documentation = "https://cyclonedx-bom-tool.readthedocs.io/"
 packages = [
-    { include = "cyclonedx_py" }
+  { include = "cyclonedx_py" }
 ]
 include = [
-    "LICENSE", "NOTICE"
+  "LICENSE", "NOTICE"
 ]
 classifiers = [
-    # Trove classifiers - https://packaging.python.org/specifications/core-metadata/#metadata-classifier
-    # Full list: https://pypi.python.org/pypi?%3Aaction=list_classifiers
-    'Development Status :: 5 - Production/Stable',
-    'Intended Audience :: Developers',
-    'Intended Audience :: Information Technology',
-    'Intended Audience :: Legal Industry',
-    'Intended Audience :: System Administrators',
-    'Topic :: Security',
-    'Topic :: Software Development',
-    'Topic :: System :: Software Distribution',
-    'License :: OSI Approved :: Apache Software License',
-    'Programming Language :: Python :: 3.8',
-    'Programming Language :: Python :: 3.9',
-    'Programming Language :: Python :: 3.10',
-    'Programming Language :: Python :: 3.11',
-    'Programming Language :: Python :: 3.12',
-    'Typing :: Typed'
+  # Trove classifiers - https://packaging.python.org/specifications/core-metadata/#metadata-classifier
+  # Full list: https://pypi.python.org/pypi?%3Aaction=list_classifiers
+  'Development Status :: 5 - Production/Stable',
+  'Intended Audience :: Developers',
+  'Intended Audience :: Information Technology',
+  'Intended Audience :: Legal Industry',
+  'Intended Audience :: System Administrators',
+  'Topic :: Security',
+  'Topic :: Software Development',
+  'Topic :: System :: Software Distribution',
+  'License :: OSI Approved :: Apache Software License',
+  'Programming Language :: Python :: 3.8',
+  'Programming Language :: Python :: 3.9',
+  'Programming Language :: Python :: 3.10',
+  'Programming Language :: Python :: 3.11',
+  'Programming Language :: Python :: 3.12',
+  'Typing :: Typed'
 ]
 
 [tool.poetry.dependencies]
 python = "^3.8"
 # ATTENTION: keep `deps.lowest.r` file in sync
-cyclonedx-python-lib = { version="^5.1.1", extras=['validation'] }
+cyclonedx-python-lib = { version = "^5.1.1", extras = ['validation'] }
 packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
 setuptools = ">= 47.0.0"
-toml = "^0.10.0"
+toml = { version = "^0.10.0", python = "<3.11" }
 chardet = "^5.1"
 
 [tool.poetry.dev-dependencies]
@@ -70,7 +70,7 @@ types-toml = "^0.10.0"
 types-setuptools = ">= 57.0.0"
 
 [tool.poetry.scripts]
-cyclonedx-py  = 'cyclonedx_py._internal.cli:run'
+cyclonedx-py = 'cyclonedx_py._internal.cli:run'
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]
diff --git a/tests/_data/infiles/poetry/group-deps-1.1-poetry.lock b/tests/_data/infiles/poetry/group-deps-1.1-poetry.lock
new file mode 100644
index 00000000..117b1ea1
--- /dev/null
+++ b/tests/_data/infiles/poetry/group-deps-1.1-poetry.lock
@@ -0,0 +1,116 @@
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+category = "dev"
+optional = false
+python-versions = ">=3.8"
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+category = "dev"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+
+[[package]]
+name = "ddt"
+version = "1.6.0"
+description = "Data-Driven/Decorated Tests"
+category = "dev"
+optional = false
+python-versions = "*"
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+category = "dev"
+optional = false
+python-versions = ">=3.7"
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+category = "dev"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+category = "dev"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+category = "main"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+category = "dev"
+optional = false
+python-versions = "*"
+
+[metadata]
+lock-version = "1.1"
+python-versions = "^3.11"
+content-hash = "3a26528623f0983570e42b51408f462ce200095d0d90add47fa74acede4cbb12"
+
+[metadata.files]
+arrow = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+colorama = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+ddt = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+isoduration = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+python-dateutil = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+six = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+toml = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+types-python-dateutil = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
diff --git a/tests/_data/infiles/poetry/group-deps-2.0-poetry.lock b/tests/_data/infiles/poetry/group-deps-2.0-poetry.lock
new file mode 100644
index 00000000..b7073417
--- /dev/null
+++ b/tests/_data/infiles/poetry/group-deps-2.0-poetry.lock
@@ -0,0 +1,108 @@
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+files = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+
+[[package]]
+name = "ddt"
+version = "1.6.0"
+description = "Data-Driven/Decorated Tests"
+optional = false
+python-versions = "*"
+files = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+files = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+optional = false
+python-versions = "*"
+files = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.11"
+content-hash = "3a26528623f0983570e42b51408f462ce200095d0d90add47fa74acede4cbb12"
diff --git a/tests/_data/infiles/poetry/group-deps-pyproject.toml b/tests/_data/infiles/poetry/group-deps-pyproject.toml
new file mode 100644
index 00000000..204529e8
--- /dev/null
+++ b/tests/_data/infiles/poetry/group-deps-pyproject.toml
@@ -0,0 +1,27 @@
+[tool.poetry]
+name = "group-deps"
+version = "0.1.0"
+description = "dependencies organized in groups"
+authors = ["Your Name <you@example.com>"]
+readme = "README.md"
+
+[tool.poetry.dependencies]
+python = "^3.11"
+toml = "^0.10.2"
+
+
+[tool.poetry.group.dev.dependencies]
+ddt = "^1.6.0"
+
+
+[tool.poetry.group.groupB.dependencies]
+isoduration = "^20.11.0"
+
+
+[tool.poetry.group.groupA.dependencies]
+isoduration = "^20.11.0"
+colorama = "^0.4.6"
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/lock-regression-issue611.txt.bin b/tests/_data/infiles/poetry/lock-regression-issue611.txt.bin
new file mode 100644
index 00000000..3f7817c1
--- /dev/null
+++ b/tests/_data/infiles/poetry/lock-regression-issue611.txt.bin
@@ -0,0 +1,17 @@
+# This file is automatically @generated by Poetry 1.6.1 and should not be changed by hand.
+
+[[package]]
+name = "pyhumps"
+version = "3.7.1"
+description = "🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node"
+optional = false
+python-versions = "*"
+files = [
+    {file = "pyhumps-3.7.1-py3-none-any.whl", hash = "sha256:c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e"},
+    {file = "pyhumps-3.7.1.tar.gz", hash = "sha256:5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da"},
+]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.11"
+content-hash = "e9676d347231afe6a46e027d88442e90348436b55346267e68a37e340c5f8f6f"
diff --git a/tests/_data/infiles/poetry/more-deps-1.0-poetry.lock b/tests/_data/infiles/poetry/more-deps-1.0-poetry.lock
new file mode 100644
index 00000000..f2db4461
--- /dev/null
+++ b/tests/_data/infiles/poetry/more-deps-1.0-poetry.lock
@@ -0,0 +1,185 @@
+[[package]]
+category = "dev"
+description = "Better dates & times for Python"
+name = "arrow"
+optional = false
+python-versions = ">=3.8"
+version = "1.3.0"
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
+
+[[package]]
+category = "main"
+description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
+name = "boolean.py"
+optional = false
+python-versions = "*"
+version = "4.0"
+
+[[package]]
+category = "main"
+description = "Python library for CycloneDX"
+name = "cyclonedx-python-lib"
+optional = false
+python-versions = ">=3.8,<4.0"
+version = "5.1.1"
+
+[package.dependencies]
+license-expression = ">=30,<31"
+packageurl-python = ">=0.11"
+py-serializable = ">=0.15,<0.16"
+sortedcontainers = ">=2.4.0,<3.0.0"
+
+[package.dependencies.jsonschema]
+extras = ["format"]
+optional = true
+version = ">=4.18,<5.0"
+
+[package.dependencies.lxml]
+optional = true
+version = ">=4,<5"
+
+[package.extras]
+json-validation = ["jsonschema (>=4.18,<5.0)"]
+validation = ["jsonschema (>=4.18,<5.0)", "lxml (>=4,<5)"]
+xml-validation = ["lxml (>=4,<5)"]
+
+[[package]]
+category = "dev"
+description = "Data-Driven/Decorated Tests"
+name = "ddt"
+optional = false
+python-versions = "*"
+version = "1.6.0"
+
+[[package]]
+category = "main"
+description = "XML bomb protection for Python stdlib modules"
+name = "defusedxml"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+version = "0.7.1"
+
+[[package]]
+category = "dev"
+description = "Operations with ISO 8601 durations"
+name = "isoduration"
+optional = false
+python-versions = ">=3.7"
+version = "20.11.0"
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+category = "main"
+description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
+name = "license-expression"
+optional = false
+python-versions = ">=3.7"
+version = "30.1.1"
+
+[package.dependencies]
+"boolean.py" = ">=4.0"
+
+[package.extras]
+docs = ["Sphinx (5.1.0)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)", "doc8 (>=0.8.1)"]
+testing = ["pytest (>=6,<7.0.0 || >7.0.0)", "pytest-xdist (>=2)", "twine", "black", "isort"]
+
+[[package]]
+category = "main"
+description = "A purl aka. Package URL parser and builder"
+name = "packageurl-python"
+optional = false
+python-versions = ">=3.7"
+version = "0.11.2"
+
+[package.extras]
+build = ["wheel"]
+lint = ["isort", "black", "mypy"]
+sqlalchemy = ["sqlalchemy (>=2.0.0)"]
+test = ["pytest"]
+
+[[package]]
+category = "main"
+description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
+name = "py-serializable"
+optional = false
+python-versions = ">=3.7,<4.0"
+version = "0.15.0"
+
+[package.dependencies]
+defusedxml = ">=0.7.1,<0.8.0"
+
+[[package]]
+category = "dev"
+description = "Extensions to the standard Python datetime module"
+name = "python-dateutil"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+version = "2.8.2"
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+category = "dev"
+description = "Python 2 and 3 compatibility utilities"
+name = "six"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+version = "1.16.0"
+
+[[package]]
+category = "main"
+description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
+name = "sortedcontainers"
+optional = false
+python-versions = "*"
+version = "2.4.0"
+
+[[package]]
+category = "dev"
+description = "Typing stubs for python-dateutil"
+name = "types-python-dateutil"
+optional = false
+python-versions = "*"
+version = "2.8.19.14"
+
+[metadata]
+content-hash = "39fdd5b51aad80a920425e37435377431d02f1018a69ab4f43e35eb1870b0aca"
+lock-version = "1.0"
+python-versions = "^3.11"
+
+[metadata.files]
+arrow = []
+"boolean.py" = []
+cyclonedx-python-lib = []
+ddt = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+defusedxml = []
+isoduration = []
+license-expression = []
+packageurl-python = []
+py-serializable = []
+python-dateutil = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+six = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+sortedcontainers = [
+    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
+    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
+]
+types-python-dateutil = []
diff --git a/tests/_data/infiles/poetry/more-deps-1.1-poetry.lock b/tests/_data/infiles/poetry/more-deps-1.1-poetry.lock
new file mode 100644
index 00000000..85498bcd
--- /dev/null
+++ b/tests/_data/infiles/poetry/more-deps-1.1-poetry.lock
@@ -0,0 +1,349 @@
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
+
+[[package]]
+name = "attrs"
+version = "23.1.0"
+description = "Classes Without Boilerplate"
+category = "main"
+optional = false
+python-versions = ">=3.7"
+
+[package.extras]
+cov = ["attrs", "coverage[toml] (>=5.3)"]
+dev = ["attrs", "pre-commit"]
+docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"]
+tests = ["attrs", "zope-interface"]
+tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist"]
+
+[[package]]
+name = "boolean.py"
+version = "4.0"
+description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
+category = "main"
+optional = false
+python-versions = "*"
+
+[[package]]
+name = "cyclonedx-python-lib"
+version = "5.1.1"
+description = "Python library for CycloneDX"
+category = "main"
+optional = false
+python-versions = ">=3.8,<4.0"
+
+[package.dependencies]
+jsonschema = {version = ">=4.18,<5.0", extras = ["format"], optional = true, markers = "extra == \"validation\" or extra == \"json-validation\""}
+license-expression = ">=30,<31"
+lxml = {version = ">=4,<5", optional = true, markers = "extra == \"validation\" or extra == \"xml-validation\""}
+packageurl-python = ">=0.11"
+py-serializable = ">=0.15,<0.16"
+sortedcontainers = ">=2.4.0,<3.0.0"
+
+[package.extras]
+json-validation = ["jsonschema[format] (>=4.18,<5.0)"]
+validation = ["jsonschema[format] (>=4.18,<5.0)", "lxml (>=4,<5)"]
+xml-validation = ["lxml (>=4,<5)"]
+
+[[package]]
+name = "ddt"
+version = "1.6.0"
+description = "Data-Driven/Decorated Tests"
+category = "dev"
+optional = false
+python-versions = "*"
+
+[[package]]
+name = "defusedxml"
+version = "0.7.1"
+description = "XML bomb protection for Python stdlib modules"
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+
+[[package]]
+name = "fqdn"
+version = "1.5.1"
+description = "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers"
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0, !=3.1, !=3.2, !=3.3, !=3.4, <4"
+
+[[package]]
+name = "idna"
+version = "3.4"
+description = "Internationalized Domain Names in Applications (IDNA)"
+category = "main"
+optional = false
+python-versions = ">=3.5"
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+category = "main"
+optional = false
+python-versions = ">=3.7"
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "jsonpointer"
+version = "2.4"
+description = "Identify specific nodes in a JSON document (RFC 6901)"
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*, !=3.6.*"
+
+[[package]]
+name = "jsonschema"
+version = "4.19.2"
+description = "An implementation of JSON Schema validation for Python"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[package.dependencies]
+attrs = ">=22.2.0"
+fqdn = {version = "*", optional = true, markers = "extra == \"format\""}
+idna = {version = "*", optional = true, markers = "extra == \"format\""}
+isoduration = {version = "*", optional = true, markers = "extra == \"format\""}
+jsonpointer = {version = ">1.13", optional = true, markers = "extra == \"format\""}
+jsonschema-specifications = ">=2023.03.6"
+referencing = ">=0.28.4"
+rfc3339-validator = {version = "*", optional = true, markers = "extra == \"format\""}
+rfc3987 = {version = "*", optional = true, markers = "extra == \"format\""}
+rpds-py = ">=0.7.1"
+uri-template = {version = "*", optional = true, markers = "extra == \"format\""}
+webcolors = {version = ">=1.11", optional = true, markers = "extra == \"format\""}
+
+[package.extras]
+format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
+format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3986-validator (>0.1.0)", "uri-template", "webcolors (>=1.11)"]
+
+[[package]]
+name = "jsonschema-specifications"
+version = "2023.7.1"
+description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[package.dependencies]
+referencing = ">=0.28.0"
+
+[[package]]
+name = "license-expression"
+version = "30.1.1"
+description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
+category = "main"
+optional = false
+python-versions = ">=3.7"
+
+[package.dependencies]
+"boolean.py" = ">=4.0"
+
+[package.extras]
+docs = ["Sphinx (==5.1.0)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)"]
+testing = ["black", "isort", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)", "twine"]
+
+[[package]]
+name = "lxml"
+version = "4.9.3"
+description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
+
+[package.extras]
+cssselect = ["cssselect (>=0.7)"]
+html5 = ["html5lib"]
+htmlsoup = ["beautifulsoup4"]
+source = ["Cython (>=0.29.35)"]
+
+[[package]]
+name = "packageurl-python"
+version = "0.11.2"
+description = "A purl aka. Package URL parser and builder"
+category = "main"
+optional = false
+python-versions = ">=3.7"
+
+[package.extras]
+build = ["wheel"]
+lint = ["black", "isort", "mypy"]
+sqlalchemy = ["sqlalchemy (>=2.0.0)"]
+test = ["pytest"]
+
+[[package]]
+name = "py-serializable"
+version = "0.15.0"
+description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
+category = "main"
+optional = false
+python-versions = ">=3.7,<4.0"
+
+[package.dependencies]
+defusedxml = ">=0.7.1,<0.8.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+category = "main"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "referencing"
+version = "0.30.2"
+description = "JSON Referencing + Python"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[package.dependencies]
+attrs = ">=22.2.0"
+rpds-py = ">=0.7.0"
+
+[[package]]
+name = "rfc3339-validator"
+version = "0.1.4"
+description = "A pure python RFC3339 validator"
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+
+[package.dependencies]
+six = "*"
+
+[[package]]
+name = "rfc3987"
+version = "1.3.8"
+description = "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)"
+category = "main"
+optional = false
+python-versions = "*"
+
+[[package]]
+name = "rpds-py"
+version = "0.12.0"
+description = "Python bindings to Rust's persistent data structures (rpds)"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[[package]]
+name = "sortedcontainers"
+version = "2.4.0"
+description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
+category = "main"
+optional = false
+python-versions = "*"
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+category = "main"
+optional = false
+python-versions = "*"
+
+[[package]]
+name = "uri-template"
+version = "1.3.0"
+description = "RFC 6570 URI Template Processor"
+category = "main"
+optional = false
+python-versions = ">=3.7"
+
+[package.extras]
+dev = ["flake8", "flake8-annotations", "flake8-bandit", "flake8-bugbear", "flake8-commas", "flake8-comprehensions", "flake8-continuation", "flake8-datetimez", "flake8-docstrings", "flake8-import-order", "flake8-literal", "flake8-modern-annotations", "flake8-noqa", "flake8-pyproject", "flake8-requirements", "flake8-typechecking-import", "flake8-use-fstring", "mypy", "pep8-naming", "types-pyyaml"]
+
+[[package]]
+name = "webcolors"
+version = "1.13"
+description = "A library for working with the color formats defined by HTML and CSS."
+category = "main"
+optional = false
+python-versions = ">=3.7"
+
+[package.extras]
+docs = ["furo", "sphinx", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-notfound-page", "sphinxext-opengraph"]
+tests = ["pytest", "pytest-cov"]
+
+[metadata]
+lock-version = "1.1"
+python-versions = "^3.11"
+content-hash = "39fdd5b51aad80a920425e37435377431d02f1018a69ab4f43e35eb1870b0aca"
+
+[metadata.files]
+arrow = []
+attrs = [
+    {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"},
+    {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"},
+]
+"boolean.py" = []
+cyclonedx-python-lib = []
+ddt = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+defusedxml = []
+fqdn = []
+idna = [
+    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
+    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
+]
+isoduration = []
+jsonpointer = []
+jsonschema = []
+jsonschema-specifications = []
+license-expression = []
+lxml = []
+packageurl-python = []
+py-serializable = []
+python-dateutil = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+referencing = []
+rfc3339-validator = []
+rfc3987 = []
+rpds-py = []
+six = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+sortedcontainers = [
+    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
+    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
+]
+types-python-dateutil = []
+uri-template = []
+webcolors = []
diff --git a/tests/_data/infiles/poetry/more-deps-2.0-poetry.lock b/tests/_data/infiles/poetry/more-deps-2.0-poetry.lock
new file mode 100644
index 00000000..08a9bbbd
--- /dev/null
+++ b/tests/_data/infiles/poetry/more-deps-2.0-poetry.lock
@@ -0,0 +1,570 @@
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
+
+[[package]]
+name = "attrs"
+version = "23.1.0"
+description = "Classes Without Boilerplate"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"},
+    {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"},
+]
+
+[package.extras]
+cov = ["attrs[tests]", "coverage[toml] (>=5.3)"]
+dev = ["attrs[docs,tests]", "pre-commit"]
+docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"]
+tests = ["attrs[tests-no-zope]", "zope-interface"]
+tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
+
+[[package]]
+name = "boolean-py"
+version = "4.0"
+description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
+optional = false
+python-versions = "*"
+files = [
+    {file = "boolean.py-4.0-py3-none-any.whl", hash = "sha256:2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"},
+    {file = "boolean.py-4.0.tar.gz", hash = "sha256:17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"},
+]
+
+[[package]]
+name = "cyclonedx-python-lib"
+version = "5.1.1"
+description = "Python library for CycloneDX"
+optional = false
+python-versions = ">=3.8,<4.0"
+files = [
+    {file = "cyclonedx_python_lib-5.1.1-py3-none-any.whl", hash = "sha256:2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"},
+    {file = "cyclonedx_python_lib-5.1.1.tar.gz", hash = "sha256:215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"},
+]
+
+[package.dependencies]
+jsonschema = {version = ">=4.18,<5.0", extras = ["format"], optional = true, markers = "extra == \"validation\" or extra == \"json-validation\""}
+license-expression = ">=30,<31"
+lxml = {version = ">=4,<5", optional = true, markers = "extra == \"validation\" or extra == \"xml-validation\""}
+packageurl-python = ">=0.11"
+py-serializable = ">=0.15,<0.16"
+sortedcontainers = ">=2.4.0,<3.0.0"
+
+[package.extras]
+json-validation = ["jsonschema[format] (>=4.18,<5.0)"]
+validation = ["jsonschema[format] (>=4.18,<5.0)", "lxml (>=4,<5)"]
+xml-validation = ["lxml (>=4,<5)"]
+
+[[package]]
+name = "ddt"
+version = "1.6.0"
+description = "Data-Driven/Decorated Tests"
+optional = false
+python-versions = "*"
+files = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+
+[[package]]
+name = "defusedxml"
+version = "0.7.1"
+description = "XML bomb protection for Python stdlib modules"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+files = [
+    {file = "defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"},
+    {file = "defusedxml-0.7.1.tar.gz", hash = "sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"},
+]
+
+[[package]]
+name = "fqdn"
+version = "1.5.1"
+description = "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers"
+optional = false
+python-versions = ">=2.7, !=3.0, !=3.1, !=3.2, !=3.3, !=3.4, <4"
+files = [
+    {file = "fqdn-1.5.1-py3-none-any.whl", hash = "sha256:3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"},
+    {file = "fqdn-1.5.1.tar.gz", hash = "sha256:105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"},
+]
+
+[[package]]
+name = "idna"
+version = "3.4"
+description = "Internationalized Domain Names in Applications (IDNA)"
+optional = false
+python-versions = ">=3.5"
+files = [
+    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
+    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
+]
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "jsonpointer"
+version = "2.4"
+description = "Identify specific nodes in a JSON document (RFC 6901)"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*, !=3.6.*"
+files = [
+    {file = "jsonpointer-2.4-py2.py3-none-any.whl", hash = "sha256:15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"},
+    {file = "jsonpointer-2.4.tar.gz", hash = "sha256:585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"},
+]
+
+[[package]]
+name = "jsonschema"
+version = "4.19.2"
+description = "An implementation of JSON Schema validation for Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "jsonschema-4.19.2-py3-none-any.whl", hash = "sha256:eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"},
+    {file = "jsonschema-4.19.2.tar.gz", hash = "sha256:c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"},
+]
+
+[package.dependencies]
+attrs = ">=22.2.0"
+fqdn = {version = "*", optional = true, markers = "extra == \"format\""}
+idna = {version = "*", optional = true, markers = "extra == \"format\""}
+isoduration = {version = "*", optional = true, markers = "extra == \"format\""}
+jsonpointer = {version = ">1.13", optional = true, markers = "extra == \"format\""}
+jsonschema-specifications = ">=2023.03.6"
+referencing = ">=0.28.4"
+rfc3339-validator = {version = "*", optional = true, markers = "extra == \"format\""}
+rfc3987 = {version = "*", optional = true, markers = "extra == \"format\""}
+rpds-py = ">=0.7.1"
+uri-template = {version = "*", optional = true, markers = "extra == \"format\""}
+webcolors = {version = ">=1.11", optional = true, markers = "extra == \"format\""}
+
+[package.extras]
+format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
+format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3986-validator (>0.1.0)", "uri-template", "webcolors (>=1.11)"]
+
+[[package]]
+name = "jsonschema-specifications"
+version = "2023.7.1"
+description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "jsonschema_specifications-2023.7.1-py3-none-any.whl", hash = "sha256:05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"},
+    {file = "jsonschema_specifications-2023.7.1.tar.gz", hash = "sha256:c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"},
+]
+
+[package.dependencies]
+referencing = ">=0.28.0"
+
+[[package]]
+name = "license-expression"
+version = "30.1.1"
+description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "license-expression-30.1.1.tar.gz", hash = "sha256:42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"},
+    {file = "license_expression-30.1.1-py3-none-any.whl", hash = "sha256:8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"},
+]
+
+[package.dependencies]
+"boolean.py" = ">=4.0"
+
+[package.extras]
+docs = ["Sphinx (==5.1.0)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)"]
+testing = ["black", "isort", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)", "twine"]
+
+[[package]]
+name = "lxml"
+version = "4.9.3"
+description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
+files = [
+    {file = "lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl", hash = "sha256:b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"},
+    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"},
+    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"},
+    {file = "lxml-4.9.3-cp27-cp27m-win32.whl", hash = "sha256:2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"},
+    {file = "lxml-4.9.3-cp27-cp27m-win_amd64.whl", hash = "sha256:4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"},
+    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"},
+    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"},
+    {file = "lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"},
+    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"},
+    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"},
+    {file = "lxml-4.9.3-cp310-cp310-win32.whl", hash = "sha256:cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"},
+    {file = "lxml-4.9.3-cp310-cp310-win_amd64.whl", hash = "sha256:97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"},
+    {file = "lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"},
+    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"},
+    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"},
+    {file = "lxml-4.9.3-cp311-cp311-win32.whl", hash = "sha256:0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"},
+    {file = "lxml-4.9.3-cp311-cp311-win_amd64.whl", hash = "sha256:25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"},
+    {file = "lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"},
+    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"},
+    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"},
+    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"},
+    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"},
+    {file = "lxml-4.9.3-cp312-cp312-win_amd64.whl", hash = "sha256:d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"},
+    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"},
+    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"},
+    {file = "lxml-4.9.3-cp35-cp35m-win32.whl", hash = "sha256:704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"},
+    {file = "lxml-4.9.3-cp35-cp35m-win_amd64.whl", hash = "sha256:c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"},
+    {file = "lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl", hash = "sha256:64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl", hash = "sha256:4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"},
+    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl", hash = "sha256:0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"},
+    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl", hash = "sha256:aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"},
+    {file = "lxml-4.9.3-cp36-cp36m-win32.whl", hash = "sha256:50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"},
+    {file = "lxml-4.9.3-cp36-cp36m-win_amd64.whl", hash = "sha256:bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl", hash = "sha256:53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"},
+    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"},
+    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"},
+    {file = "lxml-4.9.3-cp37-cp37m-win32.whl", hash = "sha256:1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"},
+    {file = "lxml-4.9.3-cp37-cp37m-win_amd64.whl", hash = "sha256:120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl", hash = "sha256:6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"},
+    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"},
+    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"},
+    {file = "lxml-4.9.3-cp38-cp38-win32.whl", hash = "sha256:57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"},
+    {file = "lxml-4.9.3-cp38-cp38-win_amd64.whl", hash = "sha256:92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"},
+    {file = "lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl", hash = "sha256:9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl", hash = "sha256:303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl", hash = "sha256:5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"},
+    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"},
+    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"},
+    {file = "lxml-4.9.3-cp39-cp39-win32.whl", hash = "sha256:8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"},
+    {file = "lxml-4.9.3-cp39-cp39-win_amd64.whl", hash = "sha256:4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"},
+    {file = "lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"},
+    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"},
+    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"},
+    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl", hash = "sha256:5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl", hash = "sha256:ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"},
+    {file = "lxml-4.9.3.tar.gz", hash = "sha256:48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"},
+]
+
+[package.extras]
+cssselect = ["cssselect (>=0.7)"]
+html5 = ["html5lib"]
+htmlsoup = ["BeautifulSoup4"]
+source = ["Cython (>=0.29.35)"]
+
+[[package]]
+name = "packageurl-python"
+version = "0.11.2"
+description = "A purl aka. Package URL parser and builder"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "packageurl-python-0.11.2.tar.gz", hash = "sha256:01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"},
+    {file = "packageurl_python-0.11.2-py3-none-any.whl", hash = "sha256:799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"},
+]
+
+[package.extras]
+build = ["wheel"]
+lint = ["black", "isort", "mypy"]
+sqlalchemy = ["sqlalchemy (>=2.0.0)"]
+test = ["pytest"]
+
+[[package]]
+name = "py-serializable"
+version = "0.15.0"
+description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
+optional = false
+python-versions = ">=3.7,<4.0"
+files = [
+    {file = "py-serializable-0.15.0.tar.gz", hash = "sha256:8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"},
+    {file = "py_serializable-0.15.0-py3-none-any.whl", hash = "sha256:d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"},
+]
+
+[package.dependencies]
+defusedxml = ">=0.7.1,<0.8.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+files = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "referencing"
+version = "0.30.2"
+description = "JSON Referencing + Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "referencing-0.30.2-py3-none-any.whl", hash = "sha256:449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"},
+    {file = "referencing-0.30.2.tar.gz", hash = "sha256:794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"},
+]
+
+[package.dependencies]
+attrs = ">=22.2.0"
+rpds-py = ">=0.7.0"
+
+[[package]]
+name = "rfc3339-validator"
+version = "0.1.4"
+description = "A pure python RFC3339 validator"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+files = [
+    {file = "rfc3339_validator-0.1.4-py2.py3-none-any.whl", hash = "sha256:24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"},
+    {file = "rfc3339_validator-0.1.4.tar.gz", hash = "sha256:138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"},
+]
+
+[package.dependencies]
+six = "*"
+
+[[package]]
+name = "rfc3987"
+version = "1.3.8"
+description = "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)"
+optional = false
+python-versions = "*"
+files = [
+    {file = "rfc3987-1.3.8-py2.py3-none-any.whl", hash = "sha256:10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"},
+    {file = "rfc3987-1.3.8.tar.gz", hash = "sha256:d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"},
+]
+
+[[package]]
+name = "rpds-py"
+version = "0.12.0"
+description = "Python bindings to Rust's persistent data structures (rpds)"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl", hash = "sha256:c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"},
+    {file = "rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"},
+    {file = "rpds_py-0.12.0-cp310-none-win32.whl", hash = "sha256:7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"},
+    {file = "rpds_py-0.12.0-cp310-none-win_amd64.whl", hash = "sha256:1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"},
+    {file = "rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl", hash = "sha256:0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"},
+    {file = "rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"},
+    {file = "rpds_py-0.12.0-cp311-none-win32.whl", hash = "sha256:dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"},
+    {file = "rpds_py-0.12.0-cp311-none-win_amd64.whl", hash = "sha256:c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"},
+    {file = "rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl", hash = "sha256:9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"},
+    {file = "rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"},
+    {file = "rpds_py-0.12.0-cp312-none-win32.whl", hash = "sha256:b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"},
+    {file = "rpds_py-0.12.0-cp312-none-win_amd64.whl", hash = "sha256:8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"},
+    {file = "rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl", hash = "sha256:6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"},
+    {file = "rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"},
+    {file = "rpds_py-0.12.0-cp38-none-win32.whl", hash = "sha256:e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"},
+    {file = "rpds_py-0.12.0-cp38-none-win_amd64.whl", hash = "sha256:bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"},
+    {file = "rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl", hash = "sha256:1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"},
+    {file = "rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"},
+    {file = "rpds_py-0.12.0-cp39-none-win32.whl", hash = "sha256:b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"},
+    {file = "rpds_py-0.12.0-cp39-none-win_amd64.whl", hash = "sha256:cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl", hash = "sha256:e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl", hash = "sha256:513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl", hash = "sha256:1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl", hash = "sha256:466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl", hash = "sha256:6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"},
+    {file = "rpds_py-0.12.0.tar.gz", hash = "sha256:7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"},
+]
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+
+[[package]]
+name = "sortedcontainers"
+version = "2.4.0"
+description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
+optional = false
+python-versions = "*"
+files = [
+    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
+    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
+]
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+optional = false
+python-versions = "*"
+files = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
+
+[[package]]
+name = "uri-template"
+version = "1.3.0"
+description = "RFC 6570 URI Template Processor"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "uri-template-1.3.0.tar.gz", hash = "sha256:0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"},
+    {file = "uri_template-1.3.0-py3-none-any.whl", hash = "sha256:a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"},
+]
+
+[package.extras]
+dev = ["flake8", "flake8-annotations", "flake8-bandit", "flake8-bugbear", "flake8-commas", "flake8-comprehensions", "flake8-continuation", "flake8-datetimez", "flake8-docstrings", "flake8-import-order", "flake8-literal", "flake8-modern-annotations", "flake8-noqa", "flake8-pyproject", "flake8-requirements", "flake8-typechecking-import", "flake8-use-fstring", "mypy", "pep8-naming", "types-PyYAML"]
+
+[[package]]
+name = "webcolors"
+version = "1.13"
+description = "A library for working with the color formats defined by HTML and CSS."
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "webcolors-1.13-py3-none-any.whl", hash = "sha256:29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"},
+    {file = "webcolors-1.13.tar.gz", hash = "sha256:c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"},
+]
+
+[package.extras]
+docs = ["furo", "sphinx", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-notfound-page", "sphinxext-opengraph"]
+tests = ["pytest", "pytest-cov"]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.11"
+content-hash = "39fdd5b51aad80a920425e37435377431d02f1018a69ab4f43e35eb1870b0aca"
diff --git a/tests/_data/infiles/poetry/more-deps-pyproject.toml b/tests/_data/infiles/poetry/more-deps-pyproject.toml
new file mode 100644
index 00000000..22c93593
--- /dev/null
+++ b/tests/_data/infiles/poetry/more-deps-pyproject.toml
@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "more-deps"
+version = "0.1.0"
+description = "dependencies, extras, transitive dependencies"
+authors = ["Your Name <you@example.com>"]
+
+[tool.poetry.dependencies]
+python = "^3.11"
+cyclonedx-python-lib = {extras = ["validation"], version = "^5.1.1"}
+
+[tool.poetry.dev-dependencies]
+isoduration = "^20.11.0"
+ddt = "^1.6.0"
+
+[build-system]
+requires = ["poetry>=0.12"]
+build-backend = "poetry.masonry.api"
diff --git a/tests/_data/infiles/poetry/simple-1.0-poetry.lock b/tests/_data/infiles/poetry/simple-1.0-poetry.lock
new file mode 100644
index 00000000..3850690d
--- /dev/null
+++ b/tests/_data/infiles/poetry/simple-1.0-poetry.lock
@@ -0,0 +1,30 @@
+[[package]]
+category = "dev"
+description = "Data-Driven/Decorated Tests"
+name = "ddt"
+optional = false
+python-versions = "*"
+version = "1.6.0"
+
+[[package]]
+category = "main"
+description = "Python Library for Tom's Obvious, Minimal Language"
+name = "toml"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+version = "0.10.2"
+
+[metadata]
+content-hash = "c6714ac009c7394dbcba37e864e27f1341e55be360c97e7f66d3538ceb8eb14f"
+lock-version = "1.0"
+python-versions = "^3.11"
+
+[metadata.files]
+ddt = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+toml = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
diff --git a/tests/_data/infiles/poetry/simple-1.1-poetry.lock b/tests/_data/infiles/poetry/simple-1.1-poetry.lock
new file mode 100644
index 00000000..79add0a7
--- /dev/null
+++ b/tests/_data/infiles/poetry/simple-1.1-poetry.lock
@@ -0,0 +1,30 @@
+[[package]]
+name = "ddt"
+version = "1.6.0"
+description = "Data-Driven/Decorated Tests"
+category = "dev"
+optional = false
+python-versions = "*"
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+category = "main"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[metadata]
+lock-version = "1.1"
+python-versions = "^3.11"
+content-hash = "c6714ac009c7394dbcba37e864e27f1341e55be360c97e7f66d3538ceb8eb14f"
+
+[metadata.files]
+ddt = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+toml = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
diff --git a/tests/_data/infiles/poetry/simple-2.0-poetry.lock b/tests/_data/infiles/poetry/simple-2.0-poetry.lock
new file mode 100644
index 00000000..37c23723
--- /dev/null
+++ b/tests/_data/infiles/poetry/simple-2.0-poetry.lock
@@ -0,0 +1,30 @@
+# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand.
+
+[[package]]
+name = "ddt"
+version = "1.6.0"
+description = "Data-Driven/Decorated Tests"
+category = "dev"
+optional = false
+python-versions = "*"
+files = [
+    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
+    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+]
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+category = "main"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.11"
+content-hash = "c6714ac009c7394dbcba37e864e27f1341e55be360c97e7f66d3538ceb8eb14f"
diff --git a/tests/_data/infiles/poetry/simple-pyproject.toml b/tests/_data/infiles/poetry/simple-pyproject.toml
new file mode 100644
index 00000000..7fb9c6d6
--- /dev/null
+++ b/tests/_data/infiles/poetry/simple-pyproject.toml
@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "simple"
+version = "0.1.0"
+description = "a simple set of dependnecies"
+authors = ["Your Name <you@example.com>"]
+readme = "README.md"
+
+[tool.poetry.dependencies]
+python = "^3.11"
+toml = "^0.10.2"
+
+[tool.poetry.dev-dependencies]
+ddt = "^1.6.0"
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"

From 46c9d3453b96fd11da5647d0f7502c2c6f7ca8ec Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 4 Nov 2023 12:24:23 +0100
Subject: [PATCH 056/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              | 45 ++++++++++++-------
 ...in => regression-issue611-poetry.lock.bin} |  0
 2 files changed, 29 insertions(+), 16 deletions(-)
 rename tests/_data/infiles/poetry/{lock-regression-issue611.txt.bin => regression-issue611-poetry.lock.bin} (100%)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 12f340f6..25ed998d 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -17,7 +17,7 @@
 
 
 from enum import Enum
-from typing import TYPE_CHECKING, Any, TextIO, Tuple, Generator, List, Dict
+from typing import TYPE_CHECKING, Any, Dict, Generator, List, Optional, TextIO, Tuple
 
 from . import BomBuilder
 
@@ -29,6 +29,8 @@
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component
 
+    NameDict = Dict[str, Any]
+
 
 # !!! be as lazy loading as possible, as greedy as needed
 # TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
@@ -88,12 +90,14 @@ def _make_bom(self, lock: TextIO) -> 'Bom':
         return self._make_bom_v1(locker)
 
     @staticmethod
-    def __get_lock_version(locker: Dict[str, Any]) -> Tuple[int, ...]:
+    def __get_lock_version(locker: 'NameDict') -> Tuple[int, ...]:
         # no version defined -- assume 1.0
-        return tuple(int(v) for v in locker.get['metadata'].get('lock-version', '1.0').split('.'))
+        return tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
+
+    def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None, None]:
+        from cyclonedx.exception.model import UnknownHashTypeException
+        from cyclonedx.model import HashType
 
-    def __hashes4file(self, files: List[Dict[str, Any]]) -> Generator['HashType', None, None]:
-        from cyclonedx.model import HashType, UnknownHashTypeException
         for file in files:
             if 'hash' in file:
                 try:
@@ -101,42 +105,51 @@ def __hashes4file(self, files: List[Dict[str, Any]]) -> Generator['HashType', No
                 except UnknownHashTypeException:
                     pass
 
-    def __make_component(self, package: dict, files: List[Dict[str, Any]] = None) -> 'Component':
-        from cyclonedx.model.component import Component, ComponentScope
+    def __make_component(self, package: 'NameDict', files: Optional[List['NameDict']] = None) -> 'Component':
         from cyclonedx.model import Property
+        from cyclonedx.model.component import Component, ComponentScope
 
         return Component(
             name=package['name'],
-            version=package.get('version'),
+            version=package['version'],
             description=package.get('description'),
             scope=ComponentScope.OPTIONAL if package.get('optional') else None,
-            properties=[
+            properties=filter(None, [
                 Property(  # for backwards compatibility: category -> group
                     name=_CdxProperty.PackageGroup.value,
                     value=package['category']
                 ) if 'category' in package else None
                 # TODO actual groups -- from `pyproject.toml`
-            ],
+            ]),
             hashes=self.__hashes4file(files or package.get('files', []))
         )
 
-    def _make_bom_v1(self, lock: Dict[str, Any]) -> 'Bom':
+    def _make_bom_v1(self, lock: 'NameDict') -> 'Bom':
         from cyclonedx.model.bom import Bom
 
         metavar_files = lock.get('metavar', {}).get('files', {})
 
         bom = Bom()
 
-        components: Dict[str, Component] = {}
-
         for package in lock.get('package', []):
             component = self.__make_component(package, metavar_files.get(package['name'], []))
+            self._logger.debug('Add component: %r', component)
             bom.components.add(component)
-            components[component.name] = component
 
         # TODO dependency tree
 
         return bom
 
-    def _make_bom_v2(self, lock: Dict[str, Any]) -> 'Bom':
-        pass
+    def _make_bom_v2(self, lock: 'NameDict') -> 'Bom':
+        from cyclonedx.model.bom import Bom
+
+        bom = Bom()
+
+        for package in lock.get('package', []):
+            component = self.__make_component(package)
+            self._logger.debug('Add component: %r', component)
+            bom.components.add(component)
+
+        # TODO dependency tree
+
+        return bom
diff --git a/tests/_data/infiles/poetry/lock-regression-issue611.txt.bin b/tests/_data/infiles/poetry/regression-issue611-poetry.lock.bin
similarity index 100%
rename from tests/_data/infiles/poetry/lock-regression-issue611.txt.bin
rename to tests/_data/infiles/poetry/regression-issue611-poetry.lock.bin

From 8897f9debb7d014882cfa18317e3ca4a11af5e13 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 4 Nov 2023 13:55:04 +0100
Subject: [PATCH 057/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              |   30 +-
 cyclonedx_py/_internal/requirements.py        |    4 +-
 ...roup-deps-1.1-poetry.lock-1.0.xml-file.bin |   61 +
 ...roup-deps-1.1-poetry.lock-1.1.xml-file.bin |   53 +
 ...oup-deps-1.1-poetry.lock-1.2.json-file.bin |  107 +
 ...roup-deps-1.1-poetry.lock-1.2.xml-file.bin |   72 +
 ...oup-deps-1.1-poetry.lock-1.3.json-file.bin |  155 +
 ...roup-deps-1.1-poetry.lock-1.3.xml-file.bin |   96 +
 ...oup-deps-1.1-poetry.lock-1.4.json-file.bin |  189 ++
 ...roup-deps-1.1-poetry.lock-1.4.xml-file.bin |  122 +
 ...roup-deps-2.0-poetry.lock-1.0.xml-file.bin |   61 +
 ...roup-deps-2.0-poetry.lock-1.1.xml-file.bin |  133 +
 ...oup-deps-2.0-poetry.lock-1.2.json-file.bin |  203 ++
 ...roup-deps-2.0-poetry.lock-1.2.xml-file.bin |  152 +
 ...oup-deps-2.0-poetry.lock-1.3.json-file.bin |  299 ++
 ...roup-deps-2.0-poetry.lock-1.3.xml-file.bin |  200 ++
 ...oup-deps-2.0-poetry.lock-1.4.json-file.bin |  333 ++
 ...roup-deps-2.0-poetry.lock-1.4.xml-file.bin |  226 ++
 ...more-deps-1.0-poetry.lock-1.0.xml-file.bin |   96 +
 ...more-deps-1.0-poetry.lock-1.1.xml-file.bin |   83 +
 ...ore-deps-1.0-poetry.lock-1.2.json-file.bin |  162 +
 ...more-deps-1.0-poetry.lock-1.2.xml-file.bin |  107 +
 ...ore-deps-1.0-poetry.lock-1.3.json-file.bin |  240 ++
 ...more-deps-1.0-poetry.lock-1.3.xml-file.bin |  146 +
 ...ore-deps-1.0-poetry.lock-1.4.json-file.bin |  274 ++
 ...more-deps-1.0-poetry.lock-1.4.xml-file.bin |  172 +
 ...more-deps-1.1-poetry.lock-1.0.xml-file.bin |  187 +
 ...more-deps-1.1-poetry.lock-1.1.xml-file.bin |  161 +
 ...ore-deps-1.1-poetry.lock-1.2.json-file.bin |  305 ++
 ...more-deps-1.1-poetry.lock-1.2.xml-file.bin |  198 ++
 ...ore-deps-1.1-poetry.lock-1.3.json-file.bin |  461 +++
 ...more-deps-1.1-poetry.lock-1.3.xml-file.bin |  276 ++
 ...ore-deps-1.1-poetry.lock-1.4.json-file.bin |  495 +++
 ...more-deps-1.1-poetry.lock-1.4.xml-file.bin |  302 ++
 ...more-deps-2.0-poetry.lock-1.0.xml-file.bin |  187 +
 ...more-deps-2.0-poetry.lock-1.1.xml-file.bin | 1169 +++++++
 ...ore-deps-2.0-poetry.lock-1.2.json-file.bin | 1552 +++++++++
 ...more-deps-2.0-poetry.lock-1.2.xml-file.bin | 1206 +++++++
 ...ore-deps-2.0-poetry.lock-1.3.json-file.bin | 2986 ++++++++++++++++
 ...more-deps-2.0-poetry.lock-1.3.xml-file.bin | 1923 +++++++++++
 ...ore-deps-2.0-poetry.lock-1.4.json-file.bin | 3020 +++++++++++++++++
 ...more-deps-2.0-poetry.lock-1.4.xml-file.bin | 1949 +++++++++++
 .../simple-1.0-poetry.lock-1.0.xml-file.bin   |   19 +
 .../simple-1.0-poetry.lock-1.1.xml-file.bin   |   17 +
 .../simple-1.0-poetry.lock-1.2.json-file.bin  |   41 +
 .../simple-1.0-poetry.lock-1.2.xml-file.bin   |   30 +
 .../simple-1.0-poetry.lock-1.3.json-file.bin  |   53 +
 .../simple-1.0-poetry.lock-1.3.xml-file.bin   |   36 +
 .../simple-1.0-poetry.lock-1.4.json-file.bin  |   87 +
 .../simple-1.0-poetry.lock-1.4.xml-file.bin   |   62 +
 .../simple-1.1-poetry.lock-1.0.xml-file.bin   |   19 +
 .../simple-1.1-poetry.lock-1.1.xml-file.bin   |   17 +
 .../simple-1.1-poetry.lock-1.2.json-file.bin  |   41 +
 .../simple-1.1-poetry.lock-1.2.xml-file.bin   |   30 +
 .../simple-1.1-poetry.lock-1.3.json-file.bin  |   53 +
 .../simple-1.1-poetry.lock-1.3.xml-file.bin   |   36 +
 .../simple-1.1-poetry.lock-1.4.json-file.bin  |   87 +
 .../simple-1.1-poetry.lock-1.4.xml-file.bin   |   62 +
 .../simple-2.0-poetry.lock-1.0.xml-file.bin   |   19 +
 .../simple-2.0-poetry.lock-1.1.xml-file.bin   |   37 +
 .../simple-2.0-poetry.lock-1.2.json-file.bin  |   65 +
 .../simple-2.0-poetry.lock-1.2.xml-file.bin   |   50 +
 .../simple-2.0-poetry.lock-1.3.json-file.bin  |  101 +
 .../simple-2.0-poetry.lock-1.3.xml-file.bin   |   68 +
 .../simple-2.0-poetry.lock-1.4.json-file.bin  |  135 +
 .../simple-2.0-poetry.lock-1.4.xml-file.bin   |   94 +
 tests/integration/test_poetry.py              |   90 +
 67 files changed, 21495 insertions(+), 7 deletions(-)
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin
 create mode 100644 tests/integration/test_poetry.py

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 25ed998d..d2090d7e 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -53,6 +53,11 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        help='I HELP TODO (default: %(default)s)',
                        nargs=OPTIONAL,
                        default='poetry.lock')
+        # TODO: filtering as allowed by poetry itself
+        #  --without=GROUP     The dependency groups to ignore. (multiple values allowed)
+        #  --with=GROUP        The optional dependency groups to include. (multiple values allowed)
+        #  --only=GROUP        The only dependency groups to include. (multiple values allowed)
+        #  --dev / --no-dev    ala: Do not install the development dependencies.
         return p
 
     def __init__(self, *,
@@ -65,7 +70,6 @@ def __call__(self, *,  # type:ignore[override]
                  **kwargs: Any) -> 'Bom':
 
         try:
-            #
             lock = open(lock_file, 'rt', errors='replace')
         except OSError as err:
             raise ValueError(f"can't open {lock_file!r}: {err}")
@@ -105,11 +109,14 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
                 except UnknownHashTypeException:
                     pass
 
-    def __make_component(self, package: 'NameDict', files: Optional[List['NameDict']] = None) -> 'Component':
-        from cyclonedx.model import Property
+    def __make_component(self, package: 'NameDict', files: List['NameDict']) -> 'Component':
+        from cyclonedx.model import Property, XsUri, ExternalReference, ExternalReferenceType, HashType
+        from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model.component import Component, ComponentScope
+        from packageurl import PackageURL
 
-        return Component(
+        component = Component(
+            bom_ref=f'{package["name"]}@{package["version"]}',
             name=package['name'],
             version=package['version'],
             description=package.get('description'),
@@ -121,8 +128,19 @@ def __make_component(self, package: 'NameDict', files: Optional[List['NameDict']
                 ) if 'category' in package else None
                 # TODO actual groups -- from `pyproject.toml`
             ]),
-            hashes=self.__hashes4file(files or package.get('files', []))
+            purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
         )
+        for file in files:
+            try:
+                'hash' in file and component.external_references.add(ExternalReference(
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(component.get_pypi_url()),
+                    comment=f'file: {file["file"]}',
+                    hashes=[HashType.from_composite_str(file["hash"])]
+                ))
+            except InvalidUriException as error:
+                self._logger.debug(f'%s skipped file: %r', package['name'], file, exc_info=error)
+        return component
 
     def _make_bom_v1(self, lock: 'NameDict') -> 'Bom':
         from cyclonedx.model.bom import Bom
@@ -146,7 +164,7 @@ def _make_bom_v2(self, lock: 'NameDict') -> 'Bom':
         bom = Bom()
 
         for package in lock.get('package', []):
-            component = self.__make_component(package)
+            component = self.__make_component(package, package.get('files', []))
             self._logger.debug('Add component: %r', component)
             bom.components.add(component)
 
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 87b15d92..fad1b4a1 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -131,7 +131,9 @@ def _make_component(self, req: 'InstallRequirement') -> 'Component':
             try:
                 external_references.append(ExternalReference(
                     type=ExternalReferenceType.VCS if req.is_vcs_url else ExternalReferenceType.DISTRIBUTION,
-                    url=XsUri(req.link.url)))
+                    url=XsUri(req.link.url),
+                    hashes=[]  # TODO
+                ))
             except InvalidUriException:
                 pass  # safe to pass, as the actual line is documented as `description`
 
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..507a3485
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,61 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..e7aea997
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..96daf340
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,107 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..6eea85e4
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,72 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..82bebf48
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,155 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..f0fade9d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,96 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..af327034
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,189 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..a6a6dec2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,122 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..507a3485
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,61 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..eb5b32c3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,133 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..65f19be7
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,203 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "file: arrow-1.3.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        },
+        {
+          "comment": "file: arrow-1.3.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "file: colorama-0.4.6-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/colorama/0.4.6"
+        },
+        {
+          "comment": "file: colorama-0.4.6.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/colorama/0.4.6"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        },
+        {
+          "comment": "file: isoduration-20.11.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "file: python-dateutil-2.8.2.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        },
+        {
+          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        },
+        {
+          "comment": "file: six-1.16.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        },
+        {
+          "comment": "file: toml-0.10.2.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        },
+        {
+          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..7de91d2d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,152 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..c90c1504
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,299 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "file: arrow-1.3.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        },
+        {
+          "comment": "file: arrow-1.3.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "file: colorama-0.4.6-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/colorama/0.4.6"
+        },
+        {
+          "comment": "file: colorama-0.4.6.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/colorama/0.4.6"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        },
+        {
+          "comment": "file: isoduration-20.11.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "file: python-dateutil-2.8.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        },
+        {
+          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        },
+        {
+          "comment": "file: six-1.16.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        },
+        {
+          "comment": "file: toml-0.10.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        },
+        {
+          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..b46ea576
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,200 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..595c4d3d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,333 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "file: arrow-1.3.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        },
+        {
+          "comment": "file: arrow-1.3.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "file: colorama-0.4.6-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/colorama/0.4.6"
+        },
+        {
+          "comment": "file: colorama-0.4.6.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/colorama/0.4.6"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        },
+        {
+          "comment": "file: isoduration-20.11.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "file: python-dateutil-2.8.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        },
+        {
+          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        },
+        {
+          "comment": "file: six-1.16.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        },
+        {
+          "comment": "file: toml-0.10.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        },
+        {
+          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..2bee886b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,226 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/colorama/0.4.6</url>
+          <comment>file: colorama-0.4.6.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..29e63285
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,96 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..c2939c5f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..51f14571
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,162 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..dff61b85
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,107 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..67e475d9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,240 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..adcbca1a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,146 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..fd0adb72
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,274 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..2702933c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,172 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..4b3514f2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,187 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..19582690
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,161 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..e54bfb03
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,305 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..fa96b253
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,198 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1"/>
+    <dependency ref="jsonschema@4.19.2"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="referencing@0.30.2"/>
+    <dependency ref="rfc3339-validator@0.1.4"/>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..4c359d4c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,461 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.4",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..3312638e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,276 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1"/>
+    <dependency ref="jsonschema@4.19.2"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="referencing@0.30.2"/>
+    <dependency ref="rfc3339-validator@0.1.4"/>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..cbd17ba2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,495 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.4",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..0903ce29
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,302 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1"/>
+    <dependency ref="jsonschema@4.19.2"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="referencing@0.30.2"/>
+    <dependency ref="rfc3339-validator@0.1.4"/>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..e82e2499
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,187 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..46c518dd
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,1169 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license-expression-30.1.1.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py-serializable-0.15.0.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri-template-1.3.0.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..149a46e7
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,1552 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "file: arrow-1.3.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        },
+        {
+          "comment": "file: arrow-1.3.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "file: attrs-23.1.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/attrs/23.1.0"
+        },
+        {
+          "comment": "file: attrs-23.1.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/attrs/23.1.0"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean-py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "file: boolean.py-4.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/boolean-py/4.0"
+        },
+        {
+          "comment": "file: boolean.py-4.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/boolean-py/4.0"
+        }
+      ],
+      "name": "boolean-py",
+      "purl": "pkg:pypi/boolean-py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "file: cyclonedx_python_lib-5.1.1-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
+        },
+        {
+          "comment": "file: cyclonedx_python_lib-5.1.1.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "file: defusedxml-0.7.1-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/defusedxml/0.7.1"
+        },
+        {
+          "comment": "file: defusedxml-0.7.1.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/defusedxml/0.7.1"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "file: fqdn-1.5.1-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/fqdn/1.5.1"
+        },
+        {
+          "comment": "file: fqdn-1.5.1.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/fqdn/1.5.1"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "file: idna-3.4-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/idna/3.4"
+        },
+        {
+          "comment": "file: idna-3.4.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/idna/3.4"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        },
+        {
+          "comment": "file: isoduration-20.11.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "file: jsonpointer-2.4-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonpointer/2.4"
+        },
+        {
+          "comment": "file: jsonpointer-2.4.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonpointer/2.4"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "file: jsonschema-4.19.2-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema/4.19.2"
+        },
+        {
+          "comment": "file: jsonschema-4.19.2.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema/4.19.2"
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "file: jsonschema_specifications-2023.7.1-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
+        },
+        {
+          "comment": "file: jsonschema_specifications-2023.7.1.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "file: license-expression-30.1.1.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/license-expression/30.1.1"
+        },
+        {
+          "comment": "file: license_expression-30.1.1-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/license-expression/30.1.1"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "file: packageurl-python-0.11.2.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/packageurl-python/0.11.2"
+        },
+        {
+          "comment": "file: packageurl_python-0.11.2-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/packageurl-python/0.11.2"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "file: py-serializable-0.15.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/py-serializable/0.15.0"
+        },
+        {
+          "comment": "file: py_serializable-0.15.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/py-serializable/0.15.0"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "file: python-dateutil-2.8.2.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        },
+        {
+          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "file: referencing-0.30.2-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/referencing/0.30.2"
+        },
+        {
+          "comment": "file: referencing-0.30.2.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/referencing/0.30.2"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "file: rfc3339_validator-0.1.4-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
+        },
+        {
+          "comment": "file: rfc3339_validator-0.1.4.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "file: rfc3987-1.3.8-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3987/1.3.8"
+        },
+        {
+          "comment": "file: rfc3987-1.3.8.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3987/1.3.8"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-none-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-none-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-none-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-none-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-none-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-none-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-none-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-none-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-none-win32.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-none-win_amd64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        },
+        {
+          "comment": "file: six-1.16.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "file: sortedcontainers-2.4.0-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
+        },
+        {
+          "comment": "file: sortedcontainers-2.4.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        },
+        {
+          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "file: uri-template-1.3.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/uri-template/1.3.0"
+        },
+        {
+          "comment": "file: uri_template-1.3.0-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/uri-template/1.3.0"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "file: webcolors-1.13-py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/webcolors/1.13"
+        },
+        {
+          "comment": "file: webcolors-1.13.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/webcolors/1.13"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean-py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..a9c6a271
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,1206 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license-expression-30.1.1.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py-serializable-0.15.0.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri-template-1.3.0.tar.gz</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean-py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1"/>
+    <dependency ref="jsonschema@4.19.2"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="referencing@0.30.2"/>
+    <dependency ref="rfc3339-validator@0.1.4"/>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..ebc713f8
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,2986 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "file: arrow-1.3.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        },
+        {
+          "comment": "file: arrow-1.3.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "file: attrs-23.1.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/attrs/23.1.0"
+        },
+        {
+          "comment": "file: attrs-23.1.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/attrs/23.1.0"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean-py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "file: boolean.py-4.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/boolean-py/4.0"
+        },
+        {
+          "comment": "file: boolean.py-4.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/boolean-py/4.0"
+        }
+      ],
+      "name": "boolean-py",
+      "purl": "pkg:pypi/boolean-py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "file: cyclonedx_python_lib-5.1.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
+        },
+        {
+          "comment": "file: cyclonedx_python_lib-5.1.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "file: defusedxml-0.7.1-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/defusedxml/0.7.1"
+        },
+        {
+          "comment": "file: defusedxml-0.7.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/defusedxml/0.7.1"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "file: fqdn-1.5.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/fqdn/1.5.1"
+        },
+        {
+          "comment": "file: fqdn-1.5.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/fqdn/1.5.1"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "file: idna-3.4-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/idna/3.4"
+        },
+        {
+          "comment": "file: idna-3.4.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/idna/3.4"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        },
+        {
+          "comment": "file: isoduration-20.11.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "file: jsonpointer-2.4-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonpointer/2.4"
+        },
+        {
+          "comment": "file: jsonpointer-2.4.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonpointer/2.4"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "file: jsonschema-4.19.2-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema/4.19.2"
+        },
+        {
+          "comment": "file: jsonschema-4.19.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema/4.19.2"
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "file: jsonschema_specifications-2023.7.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
+        },
+        {
+          "comment": "file: jsonschema_specifications-2023.7.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "file: license-expression-30.1.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/license-expression/30.1.1"
+        },
+        {
+          "comment": "file: license_expression-30.1.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/license-expression/30.1.1"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "file: packageurl-python-0.11.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/packageurl-python/0.11.2"
+        },
+        {
+          "comment": "file: packageurl_python-0.11.2-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/packageurl-python/0.11.2"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "file: py-serializable-0.15.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/py-serializable/0.15.0"
+        },
+        {
+          "comment": "file: py_serializable-0.15.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/py-serializable/0.15.0"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "file: python-dateutil-2.8.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        },
+        {
+          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "file: referencing-0.30.2-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/referencing/0.30.2"
+        },
+        {
+          "comment": "file: referencing-0.30.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/referencing/0.30.2"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "file: rfc3339_validator-0.1.4-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
+        },
+        {
+          "comment": "file: rfc3339_validator-0.1.4.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "file: rfc3987-1.3.8-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3987/1.3.8"
+        },
+        {
+          "comment": "file: rfc3987-1.3.8.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3987/1.3.8"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        },
+        {
+          "comment": "file: six-1.16.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "file: sortedcontainers-2.4.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
+        },
+        {
+          "comment": "file: sortedcontainers-2.4.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        },
+        {
+          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "file: uri-template-1.3.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/uri-template/1.3.0"
+        },
+        {
+          "comment": "file: uri_template-1.3.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/uri-template/1.3.0"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "file: webcolors-1.13-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/webcolors/1.13"
+        },
+        {
+          "comment": "file: webcolors-1.13.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/webcolors/1.13"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean-py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..1c347fb7
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,1923 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license-expression-30.1.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py-serializable-0.15.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri-template-1.3.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean-py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1"/>
+    <dependency ref="jsonschema@4.19.2"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="referencing@0.30.2"/>
+    <dependency ref="rfc3339-validator@0.1.4"/>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..0b189fd0
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,3020 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "file: arrow-1.3.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        },
+        {
+          "comment": "file: arrow-1.3.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/arrow/1.3.0"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "file: attrs-23.1.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/attrs/23.1.0"
+        },
+        {
+          "comment": "file: attrs-23.1.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/attrs/23.1.0"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean-py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "file: boolean.py-4.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/boolean-py/4.0"
+        },
+        {
+          "comment": "file: boolean.py-4.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/boolean-py/4.0"
+        }
+      ],
+      "name": "boolean-py",
+      "purl": "pkg:pypi/boolean-py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "file: cyclonedx_python_lib-5.1.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
+        },
+        {
+          "comment": "file: cyclonedx_python_lib-5.1.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "file: defusedxml-0.7.1-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/defusedxml/0.7.1"
+        },
+        {
+          "comment": "file: defusedxml-0.7.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/defusedxml/0.7.1"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "file: fqdn-1.5.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/fqdn/1.5.1"
+        },
+        {
+          "comment": "file: fqdn-1.5.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/fqdn/1.5.1"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "file: idna-3.4-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/idna/3.4"
+        },
+        {
+          "comment": "file: idna-3.4.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/idna/3.4"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        },
+        {
+          "comment": "file: isoduration-20.11.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/isoduration/20.11.0"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "file: jsonpointer-2.4-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonpointer/2.4"
+        },
+        {
+          "comment": "file: jsonpointer-2.4.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonpointer/2.4"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "file: jsonschema-4.19.2-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema/4.19.2"
+        },
+        {
+          "comment": "file: jsonschema-4.19.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema/4.19.2"
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "file: jsonschema_specifications-2023.7.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
+        },
+        {
+          "comment": "file: jsonschema_specifications-2023.7.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "file: license-expression-30.1.1.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/license-expression/30.1.1"
+        },
+        {
+          "comment": "file: license_expression-30.1.1-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/license-expression/30.1.1"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp310-cp310-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp311-cp311-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp312-cp312-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp35-cp35m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp36-cp36m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp37-cp37m-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp38-cp38-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-cp39-cp39-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        },
+        {
+          "comment": "file: lxml-4.9.3.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/lxml/4.9.3"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "file: packageurl-python-0.11.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/packageurl-python/0.11.2"
+        },
+        {
+          "comment": "file: packageurl_python-0.11.2-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/packageurl-python/0.11.2"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "file: py-serializable-0.15.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/py-serializable/0.15.0"
+        },
+        {
+          "comment": "file: py_serializable-0.15.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/py-serializable/0.15.0"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "file: python-dateutil-2.8.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        },
+        {
+          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/python-dateutil/2.8.2"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "file: referencing-0.30.2-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/referencing/0.30.2"
+        },
+        {
+          "comment": "file: referencing-0.30.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/referencing/0.30.2"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "file: rfc3339_validator-0.1.4-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
+        },
+        {
+          "comment": "file: rfc3339_validator-0.1.4.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "file: rfc3987-1.3.8-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3987/1.3.8"
+        },
+        {
+          "comment": "file: rfc3987-1.3.8.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rfc3987/1.3.8"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp310-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp311-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp312-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp38-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-none-win32.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-cp39-none-win_amd64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        },
+        {
+          "comment": "file: rpds_py-0.12.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/rpds-py/0.12.0"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        },
+        {
+          "comment": "file: six-1.16.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/six/1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "file: sortedcontainers-2.4.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
+        },
+        {
+          "comment": "file: sortedcontainers-2.4.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        },
+        {
+          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "file: uri-template-1.3.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/uri-template/1.3.0"
+        },
+        {
+          "comment": "file: uri_template-1.3.0-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/uri-template/1.3.0"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "file: webcolors-1.13-py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/webcolors/1.13"
+        },
+        {
+          "comment": "file: webcolors-1.13.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/webcolors/1.13"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean-py@4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..d5aeaac4
--- /dev/null
+++ b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,1949 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/arrow/1.3.0</url>
+          <comment>file: arrow-1.3.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/attrs/23.1.0</url>
+          <comment>file: attrs-23.1.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/boolean-py/4.0</url>
+          <comment>file: boolean.py-4.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
+          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/defusedxml/0.7.1</url>
+          <comment>file: defusedxml-0.7.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/fqdn/1.5.1</url>
+          <comment>file: fqdn-1.5.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/idna/3.4</url>
+          <comment>file: idna-3.4.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/isoduration/20.11.0</url>
+          <comment>file: isoduration-20.11.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonpointer/2.4</url>
+          <comment>file: jsonpointer-2.4.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema/4.19.2</url>
+          <comment>file: jsonschema-4.19.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
+          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license-expression-30.1.1.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/license-expression/30.1.1</url>
+          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/lxml/4.9.3</url>
+          <comment>file: lxml-4.9.3.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
+          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py-serializable-0.15.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/py-serializable/0.15.0</url>
+          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
+          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/referencing/0.30.2</url>
+          <comment>file: referencing-0.30.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
+          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rfc3987/1.3.8</url>
+          <comment>file: rfc3987-1.3.8.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/rpds-py/0.12.0</url>
+          <comment>file: rpds_py-0.12.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/six/1.16.0</url>
+          <comment>file: six-1.16.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
+          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
+          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri-template-1.3.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/uri-template/1.3.0</url>
+          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/webcolors/1.13</url>
+          <comment>file: webcolors-1.13.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0"/>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean-py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="isoduration@20.11.0"/>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1"/>
+    <dependency ref="jsonschema@4.19.2"/>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0"/>
+    <dependency ref="python-dateutil@2.8.2"/>
+    <dependency ref="referencing@0.30.2"/>
+    <dependency ref="rfc3339-validator@0.1.4"/>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..cd92a4cb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,19 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..3df273f0
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..560fd553
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,41 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..f915c24e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,30 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..9b5b0e2d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,53 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..ece81661
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,36 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..88d6b780
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,87 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..29049f25
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,62 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..cd92a4cb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,19 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..3df273f0
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..560fd553
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,41 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..f915c24e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,30 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..9b5b0e2d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,53 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..ece81661
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,36 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..88d6b780
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,87 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..29049f25
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,62 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin
new file mode 100644
index 00000000..cd92a4cb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin
@@ -0,0 +1,19 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin
new file mode 100644
index 00000000..4530a313
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin
@@ -0,0 +1,37 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin
new file mode 100644
index 00000000..0f0611f4
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin
@@ -0,0 +1,65 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        },
+        {
+          "comment": "file: toml-0.10.2.tar.gz",
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin
new file mode 100644
index 00000000..71882b77
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin
@@ -0,0 +1,50 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin
new file mode 100644
index 00000000..92eb21bc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        },
+        {
+          "comment": "file: toml-0.10.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin
new file mode 100644
index 00000000..f15701b4
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin
@@ -0,0 +1,68 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin
new file mode 100644
index 00000000..c96c08b3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin
@@ -0,0 +1,135 @@
+{
+  "components": [
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        },
+        {
+          "comment": "file: ddt-1.6.0.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/ddt/1.6.0"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        },
+        {
+          "comment": "file: toml-0.10.2.tar.gz",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/toml/0.10.2"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin
new file mode 100644
index 00000000..b2eabd6a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin
@@ -0,0 +1,94 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/ddt/1.6.0</url>
+          <comment>file: ddt-1.6.0.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/project/toml/0.10.2</url>
+          <comment>file: toml-0.10.2.tar.gz</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
new file mode 100644
index 00000000..b674e28f
--- /dev/null
+++ b/tests/integration/test_poetry.py
@@ -0,0 +1,90 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+import os
+from contextlib import redirect_stderr, redirect_stdout
+from glob import glob
+from io import StringIO, TextIOWrapper
+from os.path import basename, join
+from typing import Any, Tuple
+from unittest import TestCase
+from unittest.mock import patch
+
+from cyclonedx.schema import OutputFormat, SchemaVersion
+from ddt import ddt, named_data
+
+from cyclonedx_py._internal.cli import run as run_cli
+from tests import INFILES_DIRECTORY, SnapshotMixin, make_comparable
+
+infiles = glob(join(INFILES_DIRECTORY, 'poetry', '*poetry.lock'))
+unsupported_of_sf = [
+    (OutputFormat.JSON, SchemaVersion.V1_1),
+    (OutputFormat.JSON, SchemaVersion.V1_0),
+]
+
+test_data = [
+    (f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of)
+    for infile in infiles
+    for sv in SchemaVersion
+    for of in OutputFormat
+    if (of, sv) not in unsupported_of_sf
+]
+
+
+@ddt
+class TestPoetry(TestCase, SnapshotMixin):
+
+    def test_cli_with_file_not_found(self) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    f'--sv={SchemaVersion.V1_4.to_version()}',
+                    f'--of={OutputFormat.XML.name}',
+                    '--outfile=-',
+                    'something-that-must-not-exist.testing'])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn("No such file or directory: 'something-that-must-not-exist.testing'", err)
+
+    @named_data(* test_data)
+    def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    infile])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}-file')
+
+    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
+        super().assertEqualSnapshot(actual, join('poetry', snapshot_name))

From e8893686fc465714a881ba4960f02c224d49391d Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 4 Nov 2023 15:04:26 +0100
Subject: [PATCH 058/155] requirements hashes fixed

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .flake8                                       |  2 +-
 cyclonedx_py/_internal/poetry.py              | 10 ++-
 cyclonedx_py/_internal/requirements.py        | 44 ++++++++---
 .../infiles/requirements/with-hashes.txt      |  4 +
 .../requirements/frozen.txt-1.0.xml-file.bin  |  4 -
 .../frozen.txt-1.0.xml-stream.bin             |  4 -
 .../requirements/frozen.txt-1.1.xml-file.bin  |  9 ++-
 .../frozen.txt-1.1.xml-stream.bin             |  9 ++-
 .../requirements/frozen.txt-1.2.json-file.bin | 10 +--
 .../frozen.txt-1.2.json-stream.bin            | 10 +--
 .../requirements/frozen.txt-1.2.xml-file.bin  |  9 ++-
 .../frozen.txt-1.2.xml-stream.bin             |  9 ++-
 .../requirements/frozen.txt-1.3.json-file.bin | 20 +++--
 .../frozen.txt-1.3.json-stream.bin            | 20 +++--
 .../requirements/frozen.txt-1.3.xml-file.bin  | 13 +++-
 .../frozen.txt-1.3.xml-stream.bin             | 13 +++-
 .../requirements/frozen.txt-1.4.json-file.bin | 20 +++--
 .../frozen.txt-1.4.json-stream.bin            | 20 +++--
 .../requirements/frozen.txt-1.4.xml-file.bin  | 13 +++-
 .../frozen.txt-1.4.xml-stream.bin             | 13 +++-
 .../requirements/local.txt-1.0.xml-file.bin   |  3 -
 .../requirements/local.txt-1.0.xml-stream.bin |  3 -
 .../requirements/local.txt-1.1.xml-file.bin   |  8 +-
 .../requirements/local.txt-1.1.xml-stream.bin |  8 +-
 .../requirements/local.txt-1.2.json-file.bin  |  6 +-
 .../local.txt-1.2.json-stream.bin             |  6 +-
 .../requirements/local.txt-1.2.xml-file.bin   |  8 +-
 .../requirements/local.txt-1.2.xml-stream.bin |  8 +-
 .../requirements/local.txt-1.3.json-file.bin  | 12 ++-
 .../local.txt-1.3.json-stream.bin             | 12 ++-
 .../requirements/local.txt-1.3.xml-file.bin   | 11 ++-
 .../requirements/local.txt-1.3.xml-stream.bin | 11 ++-
 .../requirements/local.txt-1.4.json-file.bin  | 12 ++-
 .../local.txt-1.4.json-stream.bin             | 12 ++-
 .../requirements/local.txt-1.4.xml-file.bin   | 11 ++-
 .../requirements/local.txt-1.4.xml-stream.bin | 11 ++-
 .../requirements/nested.txt-1.0.xml-file.bin  |  4 -
 .../requirements/nested.txt-1.1.xml-file.bin  |  9 ++-
 .../requirements/nested.txt-1.2.json-file.bin | 10 +--
 .../requirements/nested.txt-1.2.xml-file.bin  |  9 ++-
 .../requirements/nested.txt-1.3.json-file.bin | 20 +++--
 .../requirements/nested.txt-1.3.xml-file.bin  | 13 +++-
 .../requirements/nested.txt-1.4.json-file.bin | 20 +++--
 .../requirements/nested.txt-1.4.xml-file.bin  | 13 +++-
 .../with-hashes.txt-1.0.xml-file.bin          | 19 ++---
 .../with-hashes.txt-1.0.xml-stream.bin        | 19 ++---
 .../with-hashes.txt-1.1.xml-file.bin          | 38 ++++++---
 .../with-hashes.txt-1.1.xml-stream.bin        | 38 ++++++---
 .../with-hashes.txt-1.2.json-file.bin         | 47 ++++++-----
 .../with-hashes.txt-1.2.json-stream.bin       | 47 ++++++-----
 .../with-hashes.txt-1.2.xml-file.bin          | 39 +++++++---
 .../with-hashes.txt-1.2.xml-stream.bin        | 39 +++++++---
 .../with-hashes.txt-1.3.json-file.bin         | 77 ++++++++++++++-----
 .../with-hashes.txt-1.3.json-stream.bin       | 77 ++++++++++++++-----
 .../with-hashes.txt-1.3.xml-file.bin          | 51 +++++++++---
 .../with-hashes.txt-1.3.xml-stream.bin        | 51 +++++++++---
 .../with-hashes.txt-1.4.json-file.bin         | 76 +++++++++++++-----
 .../with-hashes.txt-1.4.json-stream.bin       | 76 +++++++++++++-----
 .../with-hashes.txt-1.4.xml-file.bin          | 50 +++++++++---
 .../with-hashes.txt-1.4.xml-stream.bin        | 50 +++++++++---
 60 files changed, 858 insertions(+), 432 deletions(-)

diff --git a/.flake8 b/.flake8
index 99bdef89..31a787d5 100644
--- a/.flake8
+++ b/.flake8
@@ -11,7 +11,7 @@ exclude =
 
 max-line-length = 120
 
-max-complexity = 10
+max-complexity = 15
 
 ignore =
     # ignore `self`, `cls` markers of flake8-annotations>=2.0
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index d2090d7e..ba1ced05 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -106,12 +106,13 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
             if 'hash' in file:
                 try:
                     yield HashType.from_composite_str(file['hash'])
-                except UnknownHashTypeException:
-                    pass
+                except UnknownHashTypeException as error:
+                    self._logger.debug('skipping hash %s', file['hash'], exc_info=error)
+                    del error
 
     def __make_component(self, package: 'NameDict', files: List['NameDict']) -> 'Component':
-        from cyclonedx.model import Property, XsUri, ExternalReference, ExternalReferenceType, HashType
         from cyclonedx.exception.model import InvalidUriException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
         from cyclonedx.model.component import Component, ComponentScope
         from packageurl import PackageURL
 
@@ -139,7 +140,8 @@ def __make_component(self, package: 'NameDict', files: List['NameDict']) -> 'Com
                     hashes=[HashType.from_composite_str(file["hash"])]
                 ))
             except InvalidUriException as error:
-                self._logger.debug(f'%s skipped file: %r', package['name'], file, exc_info=error)
+                self._logger.debug(f'%s skipped extRef for: %r', package['name'], file, exc_info=error)
+                del error
         return component
 
     def _make_bom_v1(self, lock: 'NameDict') -> 'Bom':
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index fad1b4a1..e9d3e025 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -17,7 +17,7 @@
 
 
 from os import unlink
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Generator
 
 from . import BomBuilder
 
@@ -25,6 +25,7 @@
     from argparse import ArgumentParser
     from logging import Logger
 
+    from cyclonedx.model import HashType
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component
     from pip_requirements_parser import InstallRequirement, RequirementsFile  # type:ignore[import-untyped]
@@ -101,14 +102,26 @@ def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
 
         return bom
 
+    def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None, None]:
+        from cyclonedx.exception.model import UnknownHashTypeException
+        from cyclonedx.model import HashType
+
+        for hash in req.hash_options:
+            try:
+                yield HashType.from_composite_str(hash)
+            except UnknownHashTypeException as error:
+                self._logger.debug('skipping hash %s', hash, exc_info=error)
+                del error
+
     def _make_component(self, req: 'InstallRequirement') -> 'Component':
         from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
 
         name = req.name
         version = req.get_pinned_version or None
+        hashes = list(self.__hashes4req(req))
         external_references = []
         purl_qualifiers = {}  # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
 
@@ -122,8 +135,9 @@ def _make_component(self, req: 'InstallRequirement') -> 'Component':
                         comment='local path to wheel/archive',
                         type=ExternalReferenceType.OTHER,
                         url=XsUri(req.link.url)))
-                except InvalidUriException:
-                    pass  # safe to pass, as the actual line is documented as `description`
+                except InvalidUriException as error:
+                    self._logger.debug('skipping location for line: %s', req.line, exc_info=error)
+                    del error
         elif req.is_url:
             if 'pythonhosted.org/' not in req.link.url:
                 # skip PURL bloat, do not add implicit information
@@ -132,20 +146,30 @@ def _make_component(self, req: 'InstallRequirement') -> 'Component':
                 external_references.append(ExternalReference(
                     type=ExternalReferenceType.VCS if req.is_vcs_url else ExternalReferenceType.DISTRIBUTION,
                     url=XsUri(req.link.url),
-                    hashes=[]  # TODO
+                    hashes=hashes
                 ))
-            except InvalidUriException:
-                pass  # safe to pass, as the actual line is documented as `description`
-
-        return Component(
+            except InvalidUriException as error:
+                self._logger.debug('skipping URL for line: %s', req.line, exc_info=error)
+                del error
+        component = Component(
             bom_ref=f'requirements-L{req.line_number}',
             description=f'requirements line {req.line_number}: {req.line}',
             type=ComponentType.LIBRARY,
             name=name or 'unknown',
             version=version,
-            hashes=map(HashType.from_composite_str, req.hash_options),
             purl=PackageURL(type='pypi', name=req.name, version=version,
                             qualifiers=purl_qualifiers
                             ) if not is_local and name else None,
             external_references=external_references,
         )
+        if len(hashes) > 0 and len(external_references) == 0:
+            try:
+                component.external_references.add(ExternalReference(
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(component.get_pypi_url()),
+                    hashes=hashes
+                ))
+            except InvalidUriException as error:
+                self._logger.debug('skipped hashes for: %s', req.line, exc_info=error)
+                del error
+        return component
diff --git a/tests/_data/infiles/requirements/with-hashes.txt b/tests/_data/infiles/requirements/with-hashes.txt
index 632910af..4062b8b5 100644
--- a/tests/_data/infiles/requirements/with-hashes.txt
+++ b/tests/_data/infiles/requirements/with-hashes.txt
@@ -11,3 +11,7 @@ urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe
 FooProject == 1.2 \
   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 \
   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7
+
+colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz
+    --hash=md5:9854316552d41419b678d39af443a75f
+    --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin
index fd1aada5..aef72016 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin
@@ -5,10 +5,6 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin
index fd1aada5..aef72016 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin
@@ -5,10 +5,6 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
index 78bd8599..9fbfdcab 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
@@ -5,11 +5,12 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
index 78bd8599..9fbfdcab 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
@@ -5,11 +5,12 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
index bd63a80d..a4325f8f 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
@@ -3,14 +3,10 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
index bd63a80d..a4325f8f 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
@@ -3,14 +3,10 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
index 1998d749..cfd51133 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
@@ -19,11 +19,12 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
index 1998d749..cfd51133 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
@@ -19,11 +19,12 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
index 090fcd79..8db77d9f 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
index 090fcd79..8db77d9f 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
index 0cc5a698..3603685b 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
@@ -19,11 +19,16 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
index 0cc5a698..3603685b 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
@@ -19,11 +19,16 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
index 7f64bc62..a9b7be6d 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
index 7f64bc62..a9b7be6d 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
index 2600777f..95f3b4d6 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
@@ -71,11 +71,16 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
index 2600777f..95f3b4d6 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
@@ -71,11 +71,16 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin
index 981a9215..716b9580 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin
@@ -23,9 +23,6 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
       <modified>false</modified>
     </component>
     <component type="library">
diff --git a/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin
index 981a9215..716b9580 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin
@@ -23,9 +23,6 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
       <modified>false</modified>
     </component>
     <component type="library">
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
index 5c9134b4..52ff562c 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
@@ -26,9 +26,11 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
index 5c9134b4..52ff562c 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
@@ -26,9 +26,11 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
index 68e5895b..aec79d97 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
@@ -31,10 +31,10 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "type": "distribution",
+          "url": "https://pypi.org/project/unknown"
         }
       ],
       "name": "unknown",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
index 68e5895b..aec79d97 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
@@ -31,10 +31,10 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "type": "distribution",
+          "url": "https://pypi.org/project/unknown"
         }
       ],
       "name": "unknown",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
index 45188bb8..594477e6 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
@@ -40,9 +40,11 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
index 45188bb8..594477e6 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
@@ -40,9 +40,11 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
index 1ba7a159..ef71ab04 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
@@ -31,10 +31,16 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/unknown"
         }
       ],
       "name": "unknown",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
index 1ba7a159..ef71ab04 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
@@ -31,10 +31,16 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/unknown"
         }
       ],
       "name": "unknown",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
index 42b9482b..e410fd3d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
@@ -40,9 +40,14 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+          <hashes>
+            <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
index 42b9482b..e410fd3d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
@@ -40,9 +40,14 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+          <hashes>
+            <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
index 61e58c40..cece3574 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
@@ -29,10 +29,16 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/unknown"
         }
       ],
       "name": "unknown",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
index 61e58c40..cece3574 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
@@ -29,10 +29,16 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/unknown"
         }
       ],
       "name": "unknown",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
index 7a0a6310..468d4eec 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
@@ -89,9 +89,14 @@
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+          <hashes>
+            <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
index 7a0a6310..468d4eec 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
@@ -89,9 +89,14 @@
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
-      <hashes>
-        <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
-      </hashes>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/unknown</url>
+          <hashes>
+            <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>unknown</name>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin
index fd1aada5..aef72016 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin
@@ -5,10 +5,6 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
index 78bd8599..9fbfdcab 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
@@ -5,11 +5,12 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
index bd63a80d..a4325f8f 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
@@ -3,14 +3,10 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
index 1998d749..cfd51133 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
@@ -19,11 +19,12 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
index 090fcd79..8db77d9f 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
index 0cc5a698..3603685b 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
@@ -19,11 +19,16 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
index 7f64bc62..a9b7be6d 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
index 2600777f..95f3b4d6 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
@@ -71,11 +71,16 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>colorama</name>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
index 6a66d014..3dd63b9d 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
@@ -5,10 +5,6 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
       <modified>false</modified>
     </component>
@@ -16,21 +12,20 @@
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <modified>false</modified>
     </component>
+    <component type="library">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <modified>false</modified>
+    </component>
     <component type="library">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
index 6a66d014..3dd63b9d 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
@@ -5,10 +5,6 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
       <modified>false</modified>
     </component>
@@ -16,21 +12,20 @@
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <modified>false</modified>
     </component>
+    <component type="library">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <modified>false</modified>
+    </component>
     <component type="library">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
index c799a12b..43d8b2cf 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
@@ -5,31 +5,45 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
index c799a12b..43d8b2cf 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
@@ -5,31 +5,45 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
index 05e7b1e7..e30b2ac9 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
@@ -3,14 +3,10 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
@@ -21,14 +17,10 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "type": "distribution",
+          "url": "https://pypi.org/project/certifi/2021.5.30"
         }
       ],
       "name": "certifi",
@@ -36,17 +28,27 @@
       "type": "library",
       "version": "2021.5.30"
     },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library",
+      "version": ""
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+          "type": "distribution",
+          "url": "https://pypi.org/project/urllib3/1.26.5"
         }
       ],
       "name": "urllib3",
@@ -59,6 +61,9 @@
     {
       "ref": "requirements-L11"
     },
+    {
+      "ref": "requirements-L15"
+    },
     {
       "ref": "requirements-L4"
     },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
index 05e7b1e7..e30b2ac9 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
@@ -3,14 +3,10 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
@@ -21,14 +17,10 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "type": "distribution",
+          "url": "https://pypi.org/project/certifi/2021.5.30"
         }
       ],
       "name": "certifi",
@@ -36,17 +28,27 @@
       "type": "library",
       "version": "2021.5.30"
     },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library",
+      "version": ""
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+          "type": "distribution",
+          "url": "https://pypi.org/project/urllib3/1.26.5"
         }
       ],
       "name": "urllib3",
@@ -59,6 +61,9 @@
     {
       "ref": "requirements-L11"
     },
+    {
+      "ref": "requirements-L15"
+    },
     {
       "ref": "requirements-L4"
     },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
index 8d293dc5..98d1d7a8 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
@@ -19,35 +19,50 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
index 8d293dc5..98d1d7a8 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
@@ -19,35 +19,50 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
index eb0a11e0..2b941210 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
@@ -21,14 +27,20 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/certifi/2021.5.30"
         }
       ],
       "name": "certifi",
@@ -36,17 +48,37 @@
       "type": "library",
       "version": "2021.5.30"
     },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library",
+      "version": ""
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/urllib3/1.26.5"
         }
       ],
       "name": "urllib3",
@@ -59,6 +91,9 @@
     {
       "ref": "requirements-L11"
     },
+    {
+      "ref": "requirements-L15"
+    },
     {
       "ref": "requirements-L4"
     },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
index eb0a11e0..2b941210 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
@@ -21,14 +27,20 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/certifi/2021.5.30"
         }
       ],
       "name": "certifi",
@@ -36,17 +48,37 @@
       "type": "library",
       "version": "2021.5.30"
     },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library",
+      "version": ""
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/urllib3/1.26.5"
         }
       ],
       "name": "urllib3",
@@ -59,6 +91,9 @@
     {
       "ref": "requirements-L11"
     },
+    {
+      "ref": "requirements-L15"
+    },
     {
       "ref": "requirements-L4"
     },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
index c057f665..b2e4b3d0 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
@@ -19,35 +19,62 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <hashes>
+            <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+            <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <hashes>
+            <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+            <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
index c057f665..b2e4b3d0 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
@@ -19,35 +19,62 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <hashes>
+            <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+            <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <version/>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <hashes>
+            <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+            <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
index af89579e..b4c965f7 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
@@ -21,14 +27,20 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/certifi/2021.5.30"
         }
       ],
       "name": "certifi",
@@ -36,17 +48,36 @@
       "type": "library",
       "version": "2021.5.30"
     },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/urllib3/1.26.5"
         }
       ],
       "name": "urllib3",
@@ -59,6 +90,9 @@
     {
       "ref": "requirements-L11"
     },
+    {
+      "ref": "requirements-L15"
+    },
     {
       "ref": "requirements-L4"
     },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
index af89579e..b4c965f7 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
@@ -3,14 +3,20 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
-      "hashes": [
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
-        },
-        {
-          "alg": "SHA-256",
-          "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/FooProject/1.2"
         }
       ],
       "name": "FooProject",
@@ -21,14 +27,20 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/certifi/2021.5.30"
         }
       ],
       "name": "certifi",
@@ -36,17 +48,36 @@
       "type": "library",
       "version": "2021.5.30"
     },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
-        },
+      "externalReferences": [
         {
-          "alg": "SHA-256",
-          "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/project/urllib3/1.26.5"
         }
       ],
       "name": "urllib3",
@@ -59,6 +90,9 @@
     {
       "ref": "requirements-L11"
     },
+    {
+      "ref": "requirements-L15"
+    },
     {
       "ref": "requirements-L4"
     },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
index cd03b415..8a4e074d 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
@@ -71,35 +71,61 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <hashes>
+            <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+            <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <hashes>
+            <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+            <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
index cd03b415..8a4e074d 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
@@ -71,35 +71,61 @@
       <name>FooProject</name>
       <version>1.2</version>
       <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
-      <hashes>
-        <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
-        <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
-      </hashes>
       <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/FooProject/1.2</url>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>certifi</name>
       <version>2021.5.30</version>
       <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
-      <hashes>
-        <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
-        <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
-      </hashes>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <hashes>
+            <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+            <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>colorama</name>
+      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
-      <hashes>
-        <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
-        <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
-      </hashes>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <hashes>
+            <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+            <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>

From be6213896ea4a1e71f19bc5d071d6e6c97bdd65f Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 4 Nov 2023 15:05:22 +0100
Subject: [PATCH 059/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 4 ++--
 tests/integration/test_poetry.py | 5 +----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index ba1ced05..a63ca05f 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -17,7 +17,7 @@
 
 
 from enum import Enum
-from typing import TYPE_CHECKING, Any, Dict, Generator, List, Optional, TextIO, Tuple
+from typing import TYPE_CHECKING, Any, Dict, Generator, List, TextIO, Tuple
 
 from . import BomBuilder
 
@@ -140,7 +140,7 @@ def __make_component(self, package: 'NameDict', files: List['NameDict']) -> 'Com
                     hashes=[HashType.from_composite_str(file["hash"])]
                 ))
             except InvalidUriException as error:
-                self._logger.debug(f'%s skipped extRef for: %r', package['name'], file, exc_info=error)
+                self._logger.debug('%s skipped extRef for: %r', package['name'], file, exc_info=error)
                 del error
         return component
 
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index b674e28f..2b95ff40 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -16,14 +16,11 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-import os
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob
-from io import StringIO, TextIOWrapper
+from io import StringIO
 from os.path import basename, join
-from typing import Any, Tuple
 from unittest import TestCase
-from unittest.mock import patch
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
 from ddt import ddt, named_data

From fa794561fcc104fe97a60f611678f8252c1b9f9e Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 5 Nov 2023 11:31:54 +0100
Subject: [PATCH 060/155] not ignore nested lockfiles

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .gitignore | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index f4ec3eda..e8caa947 100644
--- a/.gitignore
+++ b/.gitignore
@@ -103,22 +103,22 @@ ipython_config.py
 #   However, in case of collaboration, if having platform-specific dependencies or dependencies
 #   having no cross-platform support, pipenv may install dependencies that don't work, or not
 #   install all needed dependencies.
-Pipfile.lock
+/Pipfile.lock
 
 # poetry
 #   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
 #   This is especially recommended for binary packages to ensure reproducibility, and is more
 #   commonly ignored for libraries.
 #   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-poetry.lock
+/poetry.lock
 
 # pdm
 #   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-pdm.lock
+/pdm.lock
 #   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
 #   in version control.
 #   https://pdm.fming.dev/#use-with-ide
-.pdm.toml
+/.pdm.toml
 
 # PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
 __pypackages__/

From 3aa0a0520edd5bb1b84b5198c0ab6c248c62b5c6 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 6 Nov 2023 14:29:25 +0100
Subject: [PATCH 061/155] chore: convert poetry groups

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 6b17fb96..d065258c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -51,7 +51,7 @@ setuptools = ">= 47.0.0"
 toml = { version = "^0.10.0", python = "<3.11" }
 chardet = "^5.1"
 
-[tool.poetry.dev-dependencies]
+[tool.poetry.group.dev.dependencies]
 # pin to exact versions, if the tool/lib/plugin is process-relevant
 coverage = "7.3.1"
 ddt = "1.6.0"

From c2c0b0a24e72246e511ead5929e36a0b2f7af796 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 6 Nov 2023 14:30:16 +0100
Subject: [PATCH 062/155] help

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index e9d3e025..8f6949bd 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -58,7 +58,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                            **kwargs)
         p.add_argument('requirements_file',
                        metavar='requirements-file',
-                       help='I HELP TODO (default: %(default)s)',
+                       help='I HELP TODO (default: %(default)r in current working directory)',
                        nargs=OPTIONAL,
                        default='requirements.txt')
         return p

From 718ef9dbfe5c40de8ce00e521554589182951270 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 6 Nov 2023 16:25:01 +0100
Subject: [PATCH 063/155] docs

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pyproject.toml b/pyproject.toml
index d065258c..7053de9a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -40,6 +40,8 @@ classifiers = [
   'Programming Language :: Python :: 3.12',
   'Typing :: Typed'
 ]
+[tool.poetry.urls]
+"Bug Tracker" = "https://github.com/CycloneDX/cyclonedx-python/issues"
 
 [tool.poetry.dependencies]
 python = "^3.8"

From e2d392d511105e31657cb4cb99e5a7e7eda2607c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 6 Nov 2023 16:56:42 +0100
Subject: [PATCH 064/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 8f6949bd..6ac4a808 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -139,7 +139,7 @@ def _make_component(self, req: 'InstallRequirement') -> 'Component':
                     self._logger.debug('skipping location for line: %s', req.line, exc_info=error)
                     del error
         elif req.is_url:
-            if 'pythonhosted.org/' not in req.link.url:
+            if '://files.pythonhosted.org/' not in req.link.url:
                 # skip PURL bloat, do not add implicit information
                 purl_qualifiers['vcs_url' if req.is_vcs_url else 'download_url'] = req.link.url
             try:

From 489c8fb4dda8739fbe9789ff7e9137981f15da75 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 6 Nov 2023 16:59:19 +0100
Subject: [PATCH 065/155] cli

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py        | 21 +++++-----------
 cyclonedx_py/_internal/utils/args.py | 37 ++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 15 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/args.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 57bf74a6..65c4f82a 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -18,7 +18,7 @@
 
 import logging
 import sys
-from argparse import ArgumentParser, ArgumentTypeError, FileType, RawDescriptionHelpFormatter
+from argparse import ArgumentParser, FileType, RawDescriptionHelpFormatter
 from typing import TYPE_CHECKING, Any, Dict, List, Optional, TextIO, Type
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
@@ -45,16 +45,9 @@
 
 
 class Command:
-
-    @staticmethod
-    def _mk_OutputFormatCI(value: str) -> OutputFormat:
-        try:
-            return OutputFormat[value.upper()]
-        except KeyError:
-            raise ArgumentTypeError(f'unsupported value {value!r}')
-
     @classmethod
     def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentParser:
+        from .utils.args import argparse_type4enum, choices4enum
         p = ArgumentParser(
             description='Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.',
             formatter_class=RawDescriptionHelpFormatter,
@@ -81,13 +74,11 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                         type=SchemaVersion.from_version,
                         default=SchemaVersion.V1_4.to_version())
         op.add_argument('--of', '--output-format',
-                        help='The output format for your SBOM'
-                             f' {{choice: {", ".join(sorted(f.name for f in OutputFormat))}}}'
-                             ' (default: %(default)s)',
+                        help=f'The output format for your SBOM {choices4enum(OutputFormat)} (default: %(default)s)',
                         metavar='FORMAT',
                         dest='output_format',
                         choices=OutputFormat,
-                        type=cls._mk_OutputFormatCI,
+                        type=argparse_type4enum(OutputFormat),
                         default=OutputFormat.JSON.name)
         if BooleanOptionalAction:
             op.add_argument('--validate',
@@ -201,7 +192,7 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
                         dest='verbosity',
                         action='count',
                         default=0)
-    arg_parser = Command.make_argument_parser(sco=arg_co, **kwargs)
+    arg_parser = Command.make_argument_parser(**kwargs, sco=arg_co)
     del arg_co
     args = vars(arg_parser.parse_args(argv))
     if args['command'] is None:
@@ -222,7 +213,7 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
     logger.debug('args: %s', args)
 
     try:
-        Command(logger=logger, **args)(**args)
+        Command(**args, logger=logger)(**args)
     except Exception as error:
         logger.debug('Error: %s', error, exc_info=error)
         logger.critical(f'{error}')
diff --git a/cyclonedx_py/_internal/utils/args.py b/cyclonedx_py/_internal/utils/args.py
new file mode 100644
index 00000000..378a533f
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/args.py
@@ -0,0 +1,37 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from argparse import ArgumentTypeError
+from typing import Type, Callable, TypeVar
+from enum import Enum
+
+_E = TypeVar('_E', bound=Enum)
+
+
+def argparse_type4enum(enum: Type[_E]) -> Callable[str, _E]:
+    def str2case(value: str) -> _E:
+        try:
+            return enum[value.upper()]
+        except KeyError:
+            raise ArgumentTypeError(f'unsupported value {value!r}')
+
+    return str2case
+
+
+def choices4enum(enum: Type[Enum]) -> str:
+    return f' {{choice: {", ".join(sorted(c.name for c in enum))}}}'

From f4ad29faa81a145ae54e686d6b0c755217b75200 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 6 Nov 2023 17:16:04 +0100
Subject: [PATCH 066/155] poetry wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              |  287 +-
 tests/_data/infiles/poetry/TODO.txt           |    4 +
 .../lock11/poetry.lock}                       |    0
 .../poetry/group-deps/lock11/pyproject.toml   |    1 +
 .../lock20/poetry.lock}                       |   12 +-
 .../poetry/group-deps/lock20/pyproject.toml   |    1 +
 .../pyproject.toml}                           |    6 +-
 .../poetry/main-and-dev/lock10/poetry.lock    |   95 +
 .../poetry/main-and-dev/lock10/pyproject.toml |    1 +
 .../poetry/main-and-dev/lock11/poetry.lock    |  104 +
 .../poetry/main-and-dev/lock11/pyproject.toml |    1 +
 .../poetry/main-and-dev/lock20/poetry.lock    |   97 +
 .../poetry/main-and-dev/lock20/pyproject.toml |    1 +
 .../poetry/main-and-dev/pyproject.toml        |   25 +
 .../infiles/poetry/more-deps-1.0-poetry.lock  |  185 -
 .../infiles/poetry/more-deps-1.1-poetry.lock  |  349 --
 .../infiles/poetry/more-deps-2.0-poetry.lock  |  570 ----
 .../infiles/poetry/more-deps-pyproject.toml   |   17 -
 .../pyproject.toml}                           |    9 +-
 .../regression-issue611-poetry.lock.bin       |    0
 .../infiles/poetry/simple-1.0-poetry.lock     |   30 -
 .../infiles/poetry/simple-1.1-poetry.lock     |   30 -
 .../infiles/poetry/simple-2.0-poetry.lock     |   30 -
 .../_data/infiles/requirements/with-urls.txt  |   18 +-
 ...roup-deps-1.1-poetry.lock-1.0.xml-file.bin |   61 -
 ...roup-deps-1.1-poetry.lock-1.1.xml-file.bin |   53 -
 ...oup-deps-1.1-poetry.lock-1.2.json-file.bin |  107 -
 ...roup-deps-1.1-poetry.lock-1.2.xml-file.bin |   72 -
 ...oup-deps-1.1-poetry.lock-1.3.json-file.bin |  155 -
 ...roup-deps-1.1-poetry.lock-1.3.xml-file.bin |   96 -
 ...oup-deps-1.1-poetry.lock-1.4.json-file.bin |  189 --
 ...roup-deps-1.1-poetry.lock-1.4.xml-file.bin |  122 -
 ...roup-deps-2.0-poetry.lock-1.0.xml-file.bin |   61 -
 ...roup-deps-2.0-poetry.lock-1.1.xml-file.bin |  133 -
 ...oup-deps-2.0-poetry.lock-1.2.json-file.bin |  203 --
 ...roup-deps-2.0-poetry.lock-1.2.xml-file.bin |  152 -
 ...oup-deps-2.0-poetry.lock-1.3.json-file.bin |  299 --
 ...roup-deps-2.0-poetry.lock-1.3.xml-file.bin |  200 --
 ...oup-deps-2.0-poetry.lock-1.4.json-file.bin |  333 --
 ...roup-deps-2.0-poetry.lock-1.4.xml-file.bin |  226 --
 ...more-deps-1.0-poetry.lock-1.0.xml-file.bin |   96 -
 ...more-deps-1.0-poetry.lock-1.1.xml-file.bin |   83 -
 ...ore-deps-1.0-poetry.lock-1.2.json-file.bin |  162 -
 ...more-deps-1.0-poetry.lock-1.2.xml-file.bin |  107 -
 ...ore-deps-1.0-poetry.lock-1.3.json-file.bin |  240 --
 ...more-deps-1.0-poetry.lock-1.3.xml-file.bin |  146 -
 ...ore-deps-1.0-poetry.lock-1.4.json-file.bin |  274 --
 ...more-deps-1.0-poetry.lock-1.4.xml-file.bin |  172 -
 ...more-deps-1.1-poetry.lock-1.0.xml-file.bin |  187 -
 ...more-deps-1.1-poetry.lock-1.1.xml-file.bin |  161 -
 ...ore-deps-1.1-poetry.lock-1.2.json-file.bin |  305 --
 ...more-deps-1.1-poetry.lock-1.2.xml-file.bin |  198 --
 ...ore-deps-1.1-poetry.lock-1.3.json-file.bin |  461 ---
 ...more-deps-1.1-poetry.lock-1.3.xml-file.bin |  276 --
 ...ore-deps-1.1-poetry.lock-1.4.json-file.bin |  495 ---
 ...more-deps-1.1-poetry.lock-1.4.xml-file.bin |  302 --
 ...more-deps-2.0-poetry.lock-1.0.xml-file.bin |  187 -
 ...more-deps-2.0-poetry.lock-1.1.xml-file.bin | 1169 -------
 ...ore-deps-2.0-poetry.lock-1.2.json-file.bin | 1552 ---------
 ...more-deps-2.0-poetry.lock-1.2.xml-file.bin | 1206 -------
 ...ore-deps-2.0-poetry.lock-1.3.json-file.bin | 2986 ----------------
 ...more-deps-2.0-poetry.lock-1.3.xml-file.bin | 1923 -----------
 ...ore-deps-2.0-poetry.lock-1.4.json-file.bin | 3020 -----------------
 ...more-deps-2.0-poetry.lock-1.4.xml-file.bin | 1949 -----------
 .../simple-1.0-poetry.lock-1.0.xml-file.bin   |   19 -
 .../simple-1.0-poetry.lock-1.1.xml-file.bin   |   17 -
 .../simple-1.0-poetry.lock-1.2.json-file.bin  |   41 -
 .../simple-1.0-poetry.lock-1.2.xml-file.bin   |   30 -
 .../simple-1.0-poetry.lock-1.3.json-file.bin  |   53 -
 .../simple-1.0-poetry.lock-1.3.xml-file.bin   |   36 -
 .../simple-1.0-poetry.lock-1.4.json-file.bin  |   87 -
 .../simple-1.0-poetry.lock-1.4.xml-file.bin   |   62 -
 .../simple-1.1-poetry.lock-1.0.xml-file.bin   |   19 -
 .../simple-1.1-poetry.lock-1.1.xml-file.bin   |   17 -
 .../simple-1.1-poetry.lock-1.2.json-file.bin  |   41 -
 .../simple-1.1-poetry.lock-1.2.xml-file.bin   |   30 -
 .../simple-1.1-poetry.lock-1.3.json-file.bin  |   53 -
 .../simple-1.1-poetry.lock-1.3.xml-file.bin   |   36 -
 .../simple-1.1-poetry.lock-1.4.json-file.bin  |   87 -
 .../simple-1.1-poetry.lock-1.4.xml-file.bin   |   62 -
 .../simple-2.0-poetry.lock-1.0.xml-file.bin   |   19 -
 .../simple-2.0-poetry.lock-1.1.xml-file.bin   |   37 -
 .../simple-2.0-poetry.lock-1.2.json-file.bin  |   65 -
 .../simple-2.0-poetry.lock-1.2.xml-file.bin   |   50 -
 .../simple-2.0-poetry.lock-1.3.json-file.bin  |  101 -
 .../simple-2.0-poetry.lock-1.3.xml-file.bin   |   68 -
 .../simple-2.0-poetry.lock-1.4.json-file.bin  |  135 -
 .../simple-2.0-poetry.lock-1.4.xml-file.bin   |   94 -
 88 files changed, 578 insertions(+), 22673 deletions(-)
 create mode 100644 tests/_data/infiles/poetry/TODO.txt
 rename tests/_data/infiles/poetry/{group-deps-1.1-poetry.lock => group-deps/lock11/poetry.lock} (100%)
 create mode 120000 tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml
 rename tests/_data/infiles/poetry/{group-deps-2.0-poetry.lock => group-deps/lock20/poetry.lock} (91%)
 create mode 120000 tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml
 rename tests/_data/infiles/poetry/{group-deps-pyproject.toml => group-deps/pyproject.toml} (74%)
 create mode 100644 tests/_data/infiles/poetry/main-and-dev/lock10/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/main-and-dev/lock11/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/main-and-dev/lock20/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/main-and-dev/pyproject.toml
 delete mode 100644 tests/_data/infiles/poetry/more-deps-1.0-poetry.lock
 delete mode 100644 tests/_data/infiles/poetry/more-deps-1.1-poetry.lock
 delete mode 100644 tests/_data/infiles/poetry/more-deps-2.0-poetry.lock
 delete mode 100644 tests/_data/infiles/poetry/more-deps-pyproject.toml
 rename tests/_data/infiles/poetry/{simple-pyproject.toml => regression-issue611/pyproject.toml} (64%)
 rename tests/_data/infiles/poetry/{ => regression-issue611}/regression-issue611-poetry.lock.bin (100%)
 delete mode 100644 tests/_data/infiles/poetry/simple-1.0-poetry.lock
 delete mode 100644 tests/_data/infiles/poetry/simple-1.1-poetry.lock
 delete mode 100644 tests/_data/infiles/poetry/simple-2.0-poetry.lock
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin
 delete mode 100644 tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index a63ca05f..c00fd142 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,8 +16,10 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+import re
 from enum import Enum
-from typing import TYPE_CHECKING, Any, Dict, Generator, List, TextIO, Tuple
+from itertools import chain
+from typing import TYPE_CHECKING, Any, Dict, Generator, List, TextIO, Set, NamedTuple, Iterable, Optional
 
 from . import BomBuilder
 
@@ -44,20 +46,68 @@ class PoetryBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser
+        from argparse import ArgumentParser, ONE_OR_MORE, OPTIONAL
+        from cyclonedx.model.component import ComponentType
+        from .utils.args import argparse_type4enum
 
-        p = ArgumentParser(description='Build an SBOM based on Poetry environment.',
+        p = ArgumentParser(description='Build an SBOM based on Poetry project.',
                            **kwargs)
-        p.add_argument('lock_file',
-                       metavar='lock-file',
-                       help='I HELP TODO (default: %(default)s)',
+        # the args shall mimic the ones from poetry
+        p.add_argument('--without',
+                       metavar='GROUP',
+                       dest='groups_without',
+                       help='The dependency groups to ignore (multiple values allowed)',
+                       action='append',
+                       nargs=ONE_OR_MORE,
+                       default=[])
+        p.add_argument('--with',
+                       metavar='GROUP',
+                       dest='groups_with',
+                       help='The optional dependency groups to include (multiple values allowed)',
+                       action='append',
+                       nargs=ONE_OR_MORE,
+                       default=[])
+        p.add_argument('--only',
+                       metavar='GROUP',
+                       dest='groups_only',
+                       help='The only dependency groups to include (multiple values allowed)',
+                       action='append',
+                       nargs=ONE_OR_MORE,
+                       default=[])
+        p.add_argument('--no-dev',
+                       dest='groups_only',
+                       help='Alias for --only=main',
+                       action='append_const',
+                       const='main')
+        eg = p.add_mutually_exclusive_group()
+        eg.add_argument('--extras',
+                        metavar='EXTRAS',
+                        help='Extra sets of dependencies to include (multiple values allowed)',
+                        nargs=ONE_OR_MORE,
+                        dest='extras',
+                        default=False)
+        eg.add_argument('--all-extras',
+                        help='Include all extra dependencies (default: %(default)s)',
+                        action='store_true',
+                        dest='all_extras',
+                        default=False)
+        del eg
+        p.add_argument('project_directory',
+                       metavar='project-directory',
+                       help='The project directory for Poetry (default: current working directory)',
                        nargs=OPTIONAL,
-                       default='poetry.lock')
-        # TODO: filtering as allowed by poetry itself
-        #  --without=GROUP     The dependency groups to ignore. (multiple values allowed)
-        #  --with=GROUP        The optional dependency groups to include. (multiple values allowed)
-        #  --only=GROUP        The only dependency groups to include. (multiple values allowed)
-        #  --dev / --no-dev    ala: Do not install the development dependencies.
+                       default='.')
+        _mc_types = [ComponentType.APPLICATION,
+                     ComponentType.FIRMWARE,
+                     ComponentType.LIBRARY]
+        p.add_argument('--mc-type',
+                       metavar='TYPE',
+                       help='Type of the main component'
+                            f' {{choice: {", ".join(t.value for t in _mc_types)}}}'
+                            ' (default: %(default)s)',
+                       choices=_mc_types,
+                       type=argparse_type4enum(ComponentType),
+                       default=ComponentType.APPLICATION.value)
         return p
 
     def __init__(self, *,
@@ -66,37 +116,163 @@ def __init__(self, *,
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
-                 lock_file: str,
+                 project_directory: str,
+                 extras: List[str], all_extras: bool,
                  **kwargs: Any) -> 'Bom':
+        from os.path import join
+        import sys
+        if sys.version_info < (3, 11):
+            from toml import loads as toml_loads
+        else:
+            from tomllib import loads as toml_loads
 
+        pyproject_file = join(project_directory, 'pyproject.toml')
+        lock_file = join(project_directory, 'poetry.lock')
+        try:
+            pyproject = open(pyproject_file, 'rt', errors='replace')
+        except OSError as err:
+            raise ValueError(f"can't open {pyproject_file!r}: {err}")
         try:
             lock = open(lock_file, 'rt', errors='replace')
         except OSError as err:
+            pyproject.close()
             raise ValueError(f"can't open {lock_file!r}: {err}")
 
-        with lock:
-            return self._make_bom(lock)
+        with pyproject, lock:
+            project = toml_loads(pyproject.read())
+            po_cfg = project['tool']['poetry']
+            return self._make_bom(
+                project, toml_loads(lock.read()),
+                po_cfg.get('extras', {}).keys() if all_extras else extras,
+            )
+
+    class _LockEntry(NamedTuple):
+        name: str
+        component: 'Component'
+        dependencies: Set[str]
+        extras: Dict[str, Set[str]]
+
+    def _make_bom(self, project: 'NameDict', locker: 'NameDict',
+                  filter_extras: List[str]
+                  ) -> 'Bom':
+        from cyclonedx.model import Property
+
+        from .utils.bom import make_bom
+
+        bom = make_bom()
+
+        po_cfg = project['tool']['poetry']
+
+        bom.metadata.component = root_c = self.__component4poetryproj(po_cfg)
+        lock_data: Dict[str, self._LockEntry] = {le.name: le for le in self._parse_lock(locker)}
+
+        dep_groups = {None: po_cfg.get('dependencies', {})}
+        extra_deps = set(chain.from_iterable(
+            eds for en, eds in po_cfg.get('extras', {}).items() if en in filter_extras))
+        # TODO add more groups / dev-foo
+
+        _dep_pattern = re.compile(r'^(?P<name>.+?)(?:\[(?P<extras>.*?)\]])?$')
+
+        def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
+            if name == 'python':
+                return None
+            le = lock_data.get(name)
+            if le is None:
+                self._logger.debug('skip unlocked component: %s', name)
+                return None
+            if le.component in bom.components:
+                self._logger.debug('skipped existing component: %s', name)
+                return None
+            self._logger.debug('add component: %r', le.component)
+            bom.components.add(le.component)
+            depends_on = []
+            for dep in chain(
+                le.dependencies,
+                chain.from_iterable(le.extras.get(extra, []) for extra in extras)
+            ):
+                self._logger.debug('component %s depends on %s', name, dep)
+                depm = _dep_pattern.match(dep)
+                depends_on.append(_add_ld(
+                    depm.group('name'),
+                    set(map(str.strip, (depm.group('extras') or '').split(',')))
+                ))
+            bom.register_dependency(le.component, filter(None, depends_on))
+            return le.component
+
+        depends_on = []
+        for group_name, group_deps in dep_groups.items():
+            for dep_name, dep_spec in group_deps.items():
+                dep_spec = dep_spec if isinstance(dep_spec, dict) else {'version': dep_spec}
+                if dep_spec.get('optional', False) and dep_name not in extra_deps:
+                    self._logger.debug('skip optional dependency: %s', dep_name)
+                    continue
+                added_c = _add_ld(dep_name, dep_spec.get('extras') or [])
+                if added_c is None:
+                    continue
+                if group_name is not None:
+                    added_c.properties.add(Property(
+                        name=_CdxProperty.PackageGroup.value,
+                        value=group_name
+                    ))
+                depends_on.append(added_c)
+        bom.register_dependency(root_c, filter(None, depends_on))
 
-    def _make_bom(self, lock: TextIO) -> 'Bom':
-        import sys
+        return bom
 
-        if sys.version_info < (3, 11):
-            from toml import loads as toml_loads
-        else:
-            from tomllib import loads as toml_loads
+    def __component4poetryproj(self, po_cfg: 'NameDict') -> 'Component':
+        from cyclonedx.factory.license import LicenseFactory
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri, InvalidUriException
+        from cyclonedx.model.component import Component, ComponentType
+
+        # see spec: https://python-poetry.org/docs/pyproject/
+        comp = Component(
+            bom_ref=str(po_cfg.get('name', 'root-component')),
+            type=ComponentType.APPLICATION,  # TODO configurable,
+            name=str(po_cfg.get('name', 'unnamed')),
+            version=str(po_cfg.get('version', '')) or None,
+            description=str(po_cfg.get('description', '')) or None,
+            licenses=[LicenseFactory().make_from_string(po_cfg['license'])] if 'license' in po_cfg else None,
+            author='; '.join(po_cfg['authors']) if 'authors' in po_cfg else None,
+        )
+        for ers, ert in [
+            ('homepage', ExternalReferenceType.WEBSITE),
+            ('repository', ExternalReferenceType.VCS),
+            ('documentation', ExternalReferenceType.DOCUMENTATION),
+        ]:
+            try:
+                ExternalReference(type=ert, url=XsUri(str(po_cfg[ers])))
+            except (KeyError, InvalidUriException):
+                pass
+        known_ulr_names = {
+            'bug tracker': ExternalReferenceType.ISSUE_TRACKER,
+            'issue tracker': ExternalReferenceType.ISSUE_TRACKER,
+        }
+        for un, ul in po_cfg.get('urls', {}).items():
+            try:
+                ExternalReference(type=known_ulr_names.get(un.lower(), ExternalReferenceType.OTHER),
+                                  url=XsUri(str(ul)), comment=un)
+            except InvalidUriException:
+                pass
+        return comp
+
+    def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
+        locker.setdefault('metavar', {})
+        locker.setdefault('package', [])
 
-        locker = toml_loads(lock.read())
-        lock_version = self.__get_lock_version(locker)
+        lock_version = tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
         self._logger.debug('lock_version: %r', lock_version)
 
-        if lock_version >= (2, 0):
-            return self._make_bom_v2(locker)
-        return self._make_bom_v1(locker)
+        metavar_files = locker['metavar'].get('files', {}) if lock_version < (2,) else {}
 
-    @staticmethod
-    def __get_lock_version(locker: 'NameDict') -> Tuple[int, ...]:
-        # no version defined -- assume 1.0
-        return tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
+        package: 'NameDict'
+        for package in locker['package']:
+            package.setdefault('files', metavar_files.get(package['name'], []))
+            yield self._LockEntry(
+                package['name'],
+                self.__make_component4lock(package),
+                set(package.get('dependencies', {}).keys()),
+                {e: set(d.split(' ')[0] for d in ds) for e, ds in package.get('extras', {}).items()}
+            )
 
     def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None, None]:
         from cyclonedx.exception.model import UnknownHashTypeException
@@ -110,7 +286,12 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
                     self._logger.debug('skipping hash %s', file['hash'], exc_info=error)
                     del error
 
-    def __make_component(self, package: 'NameDict', files: List['NameDict']) -> 'Component':
+    def __make_component4lock(self, package: 'NameDict') -> 'Component':
+        # TODO:
+        #   - local deps
+        #   - private package
+        #   - from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
+
         from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
         from cyclonedx.model.component import Component, ComponentScope
@@ -127,49 +308,25 @@ def __make_component(self, package: 'NameDict', files: List['NameDict']) -> 'Com
                     name=_CdxProperty.PackageGroup.value,
                     value=package['category']
                 ) if 'category' in package else None
-                # TODO actual groups -- from `pyproject.toml`
             ]),
             purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
         )
-        for file in files:
+        """TODO
+        fles and hashes eixts, regardless of the source ...
+        need to incorporate proper with URL/local files/ etc ...
+
+        package_host = 'https://files.pythonhosted.org'
+        for file in package.get('files', []):
             try:
                 'hash' in file and component.external_references.add(ExternalReference(
                     type=ExternalReferenceType.DISTRIBUTION,
-                    url=XsUri(component.get_pypi_url()),
-                    comment=f'file: {file["file"]}',
+                    url=XsUri(
+                        # see https://warehouse.pypa.io/api-reference/integration-guide.html#predictable-urls
+                        f'{package_host}/packages/source/{component.name[0]}/{component.name}/{file["file"]}'),
                     hashes=[HashType.from_composite_str(file["hash"])]
                 ))
             except InvalidUriException as error:
                 self._logger.debug('%s skipped extRef for: %r', package['name'], file, exc_info=error)
                 del error
+        """
         return component
-
-    def _make_bom_v1(self, lock: 'NameDict') -> 'Bom':
-        from cyclonedx.model.bom import Bom
-
-        metavar_files = lock.get('metavar', {}).get('files', {})
-
-        bom = Bom()
-
-        for package in lock.get('package', []):
-            component = self.__make_component(package, metavar_files.get(package['name'], []))
-            self._logger.debug('Add component: %r', component)
-            bom.components.add(component)
-
-        # TODO dependency tree
-
-        return bom
-
-    def _make_bom_v2(self, lock: 'NameDict') -> 'Bom':
-        from cyclonedx.model.bom import Bom
-
-        bom = Bom()
-
-        for package in lock.get('package', []):
-            component = self.__make_component(package, package.get('files', []))
-            self._logger.debug('Add component: %r', component)
-            bom.components.add(component)
-
-        # TODO dependency tree
-
-        return bom
diff --git a/tests/_data/infiles/poetry/TODO.txt b/tests/_data/infiles/poetry/TODO.txt
new file mode 100644
index 00000000..9073207b
--- /dev/null
+++ b/tests/_data/infiles/poetry/TODO.txt
@@ -0,0 +1,4 @@
+- local deps
+- private package
+- from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
+- extras , direct & transitive
diff --git a/tests/_data/infiles/poetry/group-deps-1.1-poetry.lock b/tests/_data/infiles/poetry/group-deps/lock11/poetry.lock
similarity index 100%
rename from tests/_data/infiles/poetry/group-deps-1.1-poetry.lock
rename to tests/_data/infiles/poetry/group-deps/lock11/poetry.lock
diff --git a/tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml b/tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml
new file mode 120000
index 00000000..1e11d782
--- /dev/null
+++ b/tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml
@@ -0,0 +1 @@
+../pyproject.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/group-deps-2.0-poetry.lock b/tests/_data/infiles/poetry/group-deps/lock20/poetry.lock
similarity index 91%
rename from tests/_data/infiles/poetry/group-deps-2.0-poetry.lock
rename to tests/_data/infiles/poetry/group-deps/lock20/poetry.lock
index b7073417..814dba40 100644
--- a/tests/_data/infiles/poetry/group-deps-2.0-poetry.lock
+++ b/tests/_data/infiles/poetry/group-deps/lock20/poetry.lock
@@ -1,9 +1,10 @@
-# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand.
 
 [[package]]
 name = "arrow"
 version = "1.3.0"
 description = "Better dates & times for Python"
+category = "dev"
 optional = false
 python-versions = ">=3.8"
 files = [
@@ -17,12 +18,13 @@ types-python-dateutil = ">=2.8.10"
 
 [package.extras]
 doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
-test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
+test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
 
 [[package]]
 name = "colorama"
 version = "0.4.6"
 description = "Cross-platform colored terminal text."
+category = "dev"
 optional = false
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
 files = [
@@ -34,6 +36,7 @@ files = [
 name = "ddt"
 version = "1.6.0"
 description = "Data-Driven/Decorated Tests"
+category = "dev"
 optional = false
 python-versions = "*"
 files = [
@@ -45,6 +48,7 @@ files = [
 name = "isoduration"
 version = "20.11.0"
 description = "Operations with ISO 8601 durations"
+category = "dev"
 optional = false
 python-versions = ">=3.7"
 files = [
@@ -59,6 +63,7 @@ arrow = ">=0.15.0"
 name = "python-dateutil"
 version = "2.8.2"
 description = "Extensions to the standard Python datetime module"
+category = "dev"
 optional = false
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
 files = [
@@ -73,6 +78,7 @@ six = ">=1.5"
 name = "six"
 version = "1.16.0"
 description = "Python 2 and 3 compatibility utilities"
+category = "dev"
 optional = false
 python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
 files = [
@@ -84,6 +90,7 @@ files = [
 name = "toml"
 version = "0.10.2"
 description = "Python Library for Tom's Obvious, Minimal Language"
+category = "main"
 optional = false
 python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
 files = [
@@ -95,6 +102,7 @@ files = [
 name = "types-python-dateutil"
 version = "2.8.19.14"
 description = "Typing stubs for python-dateutil"
+category = "dev"
 optional = false
 python-versions = "*"
 files = [
diff --git a/tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml b/tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml
new file mode 120000
index 00000000..1e11d782
--- /dev/null
+++ b/tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml
@@ -0,0 +1 @@
+../pyproject.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/group-deps-pyproject.toml b/tests/_data/infiles/poetry/group-deps/pyproject.toml
similarity index 74%
rename from tests/_data/infiles/poetry/group-deps-pyproject.toml
rename to tests/_data/infiles/poetry/group-deps/pyproject.toml
index 204529e8..4c3db984 100644
--- a/tests/_data/infiles/poetry/group-deps-pyproject.toml
+++ b/tests/_data/infiles/poetry/group-deps/pyproject.toml
@@ -5,19 +5,19 @@ description = "dependencies organized in groups"
 authors = ["Your Name <you@example.com>"]
 readme = "README.md"
 
+# see https://python-poetry.org/docs/master/managing-dependencies/#dependency-groups
+# This group notation is preferred since Poetry 1.2.0 and not usable in earlier versions.
+
 [tool.poetry.dependencies]
 python = "^3.11"
 toml = "^0.10.2"
 
-
 [tool.poetry.group.dev.dependencies]
 ddt = "^1.6.0"
 
-
 [tool.poetry.group.groupB.dependencies]
 isoduration = "^20.11.0"
 
-
 [tool.poetry.group.groupA.dependencies]
 isoduration = "^20.11.0"
 colorama = "^0.4.6"
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock10/poetry.lock b/tests/_data/infiles/poetry/main-and-dev/lock10/poetry.lock
new file mode 100644
index 00000000..3ac03a5f
--- /dev/null
+++ b/tests/_data/infiles/poetry/main-and-dev/lock10/poetry.lock
@@ -0,0 +1,95 @@
+[[package]]
+category = "dev"
+description = "Better dates & times for Python"
+name = "arrow"
+optional = false
+python-versions = ">=3.8"
+version = "1.3.0"
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
+
+[[package]]
+category = "main"
+description = "Cross-platform colored terminal text."
+name = "colorama"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+version = "0.4.6"
+
+[[package]]
+category = "dev"
+description = "Operations with ISO 8601 durations"
+name = "isoduration"
+optional = false
+python-versions = ">=3.7"
+version = "20.11.0"
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+category = "dev"
+description = "Extensions to the standard Python datetime module"
+name = "python-dateutil"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+version = "2.8.2"
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+category = "dev"
+description = "Python 2 and 3 compatibility utilities"
+name = "six"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+version = "1.16.0"
+
+[[package]]
+category = "main"
+description = "Python Library for Tom's Obvious, Minimal Language"
+name = "toml"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+version = "0.10.2"
+
+[[package]]
+category = "dev"
+description = "Typing stubs for python-dateutil"
+name = "types-python-dateutil"
+optional = false
+python-versions = "*"
+version = "2.8.19.14"
+
+[metadata]
+content-hash = "690f86686bbb7dc2130d29a2336f68f1e28d3031b365a45f76e79b87f6ddef94"
+lock-version = "1.0"
+python-versions = "^3.8"
+
+[metadata.files]
+arrow = []
+colorama = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+isoduration = []
+python-dateutil = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+six = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+toml = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+types-python-dateutil = []
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml
new file mode 120000
index 00000000..1e11d782
--- /dev/null
+++ b/tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml
@@ -0,0 +1 @@
+../pyproject.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock11/poetry.lock b/tests/_data/infiles/poetry/main-and-dev/lock11/poetry.lock
new file mode 100644
index 00000000..0e8d8fff
--- /dev/null
+++ b/tests/_data/infiles/poetry/main-and-dev/lock11/poetry.lock
@@ -0,0 +1,104 @@
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+category = "dev"
+optional = false
+python-versions = ">=3.8"
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+category = "main"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+category = "dev"
+optional = false
+python-versions = ">=3.7"
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+category = "dev"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+category = "dev"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+category = "main"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+category = "dev"
+optional = false
+python-versions = "*"
+
+[metadata]
+lock-version = "1.1"
+python-versions = "^3.8"
+content-hash = "690f86686bbb7dc2130d29a2336f68f1e28d3031b365a45f76e79b87f6ddef94"
+
+[metadata.files]
+arrow = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+colorama = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+isoduration = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+python-dateutil = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+six = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+toml = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+types-python-dateutil = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml
new file mode 120000
index 00000000..1e11d782
--- /dev/null
+++ b/tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml
@@ -0,0 +1 @@
+../pyproject.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock20/poetry.lock b/tests/_data/infiles/poetry/main-and-dev/lock20/poetry.lock
new file mode 100644
index 00000000..f19f45e6
--- /dev/null
+++ b/tests/_data/infiles/poetry/main-and-dev/lock20/poetry.lock
@@ -0,0 +1,97 @@
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+files = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+files = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+optional = false
+python-versions = "*"
+files = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.8"
+content-hash = "690f86686bbb7dc2130d29a2336f68f1e28d3031b365a45f76e79b87f6ddef94"
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml
new file mode 120000
index 00000000..1e11d782
--- /dev/null
+++ b/tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml
@@ -0,0 +1 @@
+../pyproject.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/main-and-dev/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/pyproject.toml
new file mode 100644
index 00000000..f075dac7
--- /dev/null
+++ b/tests/_data/infiles/poetry/main-and-dev/pyproject.toml
@@ -0,0 +1,25 @@
+[tool.poetry]
+name = "main-and-dev"
+version = "0.1.0"
+description = "main and dev depenndencies"
+authors = ["Your Name <you@example.com>"]
+readme = "README.md"
+
+
+
+[tool.poetry.dependencies]
+python = "^3.8"
+toml = "^0.10.2"
+colorama = "*"
+
+# > This group notation is preferred since Poetry 1.2.0 and not usable in earlier versions.
+# > For backwards compatibility with older versions of Poetry, any dependency declared in the dev-dependencies
+# > section will automatically be added to the dev group.
+
+[tool.poetry.dev-dependencies]
+isoduration = "^20.11.0"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/more-deps-1.0-poetry.lock b/tests/_data/infiles/poetry/more-deps-1.0-poetry.lock
deleted file mode 100644
index f2db4461..00000000
--- a/tests/_data/infiles/poetry/more-deps-1.0-poetry.lock
+++ /dev/null
@@ -1,185 +0,0 @@
-[[package]]
-category = "dev"
-description = "Better dates & times for Python"
-name = "arrow"
-optional = false
-python-versions = ">=3.8"
-version = "1.3.0"
-
-[package.dependencies]
-python-dateutil = ">=2.7.0"
-types-python-dateutil = ">=2.8.10"
-
-[package.extras]
-doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
-test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
-
-[[package]]
-category = "main"
-description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
-name = "boolean.py"
-optional = false
-python-versions = "*"
-version = "4.0"
-
-[[package]]
-category = "main"
-description = "Python library for CycloneDX"
-name = "cyclonedx-python-lib"
-optional = false
-python-versions = ">=3.8,<4.0"
-version = "5.1.1"
-
-[package.dependencies]
-license-expression = ">=30,<31"
-packageurl-python = ">=0.11"
-py-serializable = ">=0.15,<0.16"
-sortedcontainers = ">=2.4.0,<3.0.0"
-
-[package.dependencies.jsonschema]
-extras = ["format"]
-optional = true
-version = ">=4.18,<5.0"
-
-[package.dependencies.lxml]
-optional = true
-version = ">=4,<5"
-
-[package.extras]
-json-validation = ["jsonschema (>=4.18,<5.0)"]
-validation = ["jsonschema (>=4.18,<5.0)", "lxml (>=4,<5)"]
-xml-validation = ["lxml (>=4,<5)"]
-
-[[package]]
-category = "dev"
-description = "Data-Driven/Decorated Tests"
-name = "ddt"
-optional = false
-python-versions = "*"
-version = "1.6.0"
-
-[[package]]
-category = "main"
-description = "XML bomb protection for Python stdlib modules"
-name = "defusedxml"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-version = "0.7.1"
-
-[[package]]
-category = "dev"
-description = "Operations with ISO 8601 durations"
-name = "isoduration"
-optional = false
-python-versions = ">=3.7"
-version = "20.11.0"
-
-[package.dependencies]
-arrow = ">=0.15.0"
-
-[[package]]
-category = "main"
-description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
-name = "license-expression"
-optional = false
-python-versions = ">=3.7"
-version = "30.1.1"
-
-[package.dependencies]
-"boolean.py" = ">=4.0"
-
-[package.extras]
-docs = ["Sphinx (5.1.0)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)", "doc8 (>=0.8.1)"]
-testing = ["pytest (>=6,<7.0.0 || >7.0.0)", "pytest-xdist (>=2)", "twine", "black", "isort"]
-
-[[package]]
-category = "main"
-description = "A purl aka. Package URL parser and builder"
-name = "packageurl-python"
-optional = false
-python-versions = ">=3.7"
-version = "0.11.2"
-
-[package.extras]
-build = ["wheel"]
-lint = ["isort", "black", "mypy"]
-sqlalchemy = ["sqlalchemy (>=2.0.0)"]
-test = ["pytest"]
-
-[[package]]
-category = "main"
-description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
-name = "py-serializable"
-optional = false
-python-versions = ">=3.7,<4.0"
-version = "0.15.0"
-
-[package.dependencies]
-defusedxml = ">=0.7.1,<0.8.0"
-
-[[package]]
-category = "dev"
-description = "Extensions to the standard Python datetime module"
-name = "python-dateutil"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-version = "2.8.2"
-
-[package.dependencies]
-six = ">=1.5"
-
-[[package]]
-category = "dev"
-description = "Python 2 and 3 compatibility utilities"
-name = "six"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-version = "1.16.0"
-
-[[package]]
-category = "main"
-description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
-name = "sortedcontainers"
-optional = false
-python-versions = "*"
-version = "2.4.0"
-
-[[package]]
-category = "dev"
-description = "Typing stubs for python-dateutil"
-name = "types-python-dateutil"
-optional = false
-python-versions = "*"
-version = "2.8.19.14"
-
-[metadata]
-content-hash = "39fdd5b51aad80a920425e37435377431d02f1018a69ab4f43e35eb1870b0aca"
-lock-version = "1.0"
-python-versions = "^3.11"
-
-[metadata.files]
-arrow = []
-"boolean.py" = []
-cyclonedx-python-lib = []
-ddt = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-defusedxml = []
-isoduration = []
-license-expression = []
-packageurl-python = []
-py-serializable = []
-python-dateutil = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
-]
-six = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-sortedcontainers = [
-    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
-    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
-]
-types-python-dateutil = []
diff --git a/tests/_data/infiles/poetry/more-deps-1.1-poetry.lock b/tests/_data/infiles/poetry/more-deps-1.1-poetry.lock
deleted file mode 100644
index 85498bcd..00000000
--- a/tests/_data/infiles/poetry/more-deps-1.1-poetry.lock
+++ /dev/null
@@ -1,349 +0,0 @@
-[[package]]
-name = "arrow"
-version = "1.3.0"
-description = "Better dates & times for Python"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-
-[package.dependencies]
-python-dateutil = ">=2.7.0"
-types-python-dateutil = ">=2.8.10"
-
-[package.extras]
-doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
-test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
-
-[[package]]
-name = "attrs"
-version = "23.1.0"
-description = "Classes Without Boilerplate"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.extras]
-cov = ["attrs", "coverage[toml] (>=5.3)"]
-dev = ["attrs", "pre-commit"]
-docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"]
-tests = ["attrs", "zope-interface"]
-tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist"]
-
-[[package]]
-name = "boolean.py"
-version = "4.0"
-description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "cyclonedx-python-lib"
-version = "5.1.1"
-description = "Python library for CycloneDX"
-category = "main"
-optional = false
-python-versions = ">=3.8,<4.0"
-
-[package.dependencies]
-jsonschema = {version = ">=4.18,<5.0", extras = ["format"], optional = true, markers = "extra == \"validation\" or extra == \"json-validation\""}
-license-expression = ">=30,<31"
-lxml = {version = ">=4,<5", optional = true, markers = "extra == \"validation\" or extra == \"xml-validation\""}
-packageurl-python = ">=0.11"
-py-serializable = ">=0.15,<0.16"
-sortedcontainers = ">=2.4.0,<3.0.0"
-
-[package.extras]
-json-validation = ["jsonschema[format] (>=4.18,<5.0)"]
-validation = ["jsonschema[format] (>=4.18,<5.0)", "lxml (>=4,<5)"]
-xml-validation = ["lxml (>=4,<5)"]
-
-[[package]]
-name = "ddt"
-version = "1.6.0"
-description = "Data-Driven/Decorated Tests"
-category = "dev"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "defusedxml"
-version = "0.7.1"
-description = "XML bomb protection for Python stdlib modules"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-
-[[package]]
-name = "fqdn"
-version = "1.5.1"
-description = "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0, !=3.1, !=3.2, !=3.3, !=3.4, <4"
-
-[[package]]
-name = "idna"
-version = "3.4"
-description = "Internationalized Domain Names in Applications (IDNA)"
-category = "main"
-optional = false
-python-versions = ">=3.5"
-
-[[package]]
-name = "isoduration"
-version = "20.11.0"
-description = "Operations with ISO 8601 durations"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.dependencies]
-arrow = ">=0.15.0"
-
-[[package]]
-name = "jsonpointer"
-version = "2.4"
-description = "Identify specific nodes in a JSON document (RFC 6901)"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*, !=3.6.*"
-
-[[package]]
-name = "jsonschema"
-version = "4.19.2"
-description = "An implementation of JSON Schema validation for Python"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-
-[package.dependencies]
-attrs = ">=22.2.0"
-fqdn = {version = "*", optional = true, markers = "extra == \"format\""}
-idna = {version = "*", optional = true, markers = "extra == \"format\""}
-isoduration = {version = "*", optional = true, markers = "extra == \"format\""}
-jsonpointer = {version = ">1.13", optional = true, markers = "extra == \"format\""}
-jsonschema-specifications = ">=2023.03.6"
-referencing = ">=0.28.4"
-rfc3339-validator = {version = "*", optional = true, markers = "extra == \"format\""}
-rfc3987 = {version = "*", optional = true, markers = "extra == \"format\""}
-rpds-py = ">=0.7.1"
-uri-template = {version = "*", optional = true, markers = "extra == \"format\""}
-webcolors = {version = ">=1.11", optional = true, markers = "extra == \"format\""}
-
-[package.extras]
-format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
-format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3986-validator (>0.1.0)", "uri-template", "webcolors (>=1.11)"]
-
-[[package]]
-name = "jsonschema-specifications"
-version = "2023.7.1"
-description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-
-[package.dependencies]
-referencing = ">=0.28.0"
-
-[[package]]
-name = "license-expression"
-version = "30.1.1"
-description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.dependencies]
-"boolean.py" = ">=4.0"
-
-[package.extras]
-docs = ["Sphinx (==5.1.0)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)"]
-testing = ["black", "isort", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)", "twine"]
-
-[[package]]
-name = "lxml"
-version = "4.9.3"
-description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
-
-[package.extras]
-cssselect = ["cssselect (>=0.7)"]
-html5 = ["html5lib"]
-htmlsoup = ["beautifulsoup4"]
-source = ["Cython (>=0.29.35)"]
-
-[[package]]
-name = "packageurl-python"
-version = "0.11.2"
-description = "A purl aka. Package URL parser and builder"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.extras]
-build = ["wheel"]
-lint = ["black", "isort", "mypy"]
-sqlalchemy = ["sqlalchemy (>=2.0.0)"]
-test = ["pytest"]
-
-[[package]]
-name = "py-serializable"
-version = "0.15.0"
-description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-
-[package.dependencies]
-defusedxml = ">=0.7.1,<0.8.0"
-
-[[package]]
-name = "python-dateutil"
-version = "2.8.2"
-description = "Extensions to the standard Python datetime module"
-category = "main"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-
-[package.dependencies]
-six = ">=1.5"
-
-[[package]]
-name = "referencing"
-version = "0.30.2"
-description = "JSON Referencing + Python"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-
-[package.dependencies]
-attrs = ">=22.2.0"
-rpds-py = ">=0.7.0"
-
-[[package]]
-name = "rfc3339-validator"
-version = "0.1.4"
-description = "A pure python RFC3339 validator"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-
-[package.dependencies]
-six = "*"
-
-[[package]]
-name = "rfc3987"
-version = "1.3.8"
-description = "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "rpds-py"
-version = "0.12.0"
-description = "Python bindings to Rust's persistent data structures (rpds)"
-category = "main"
-optional = false
-python-versions = ">=3.8"
-
-[[package]]
-name = "six"
-version = "1.16.0"
-description = "Python 2 and 3 compatibility utilities"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-
-[[package]]
-name = "sortedcontainers"
-version = "2.4.0"
-description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "types-python-dateutil"
-version = "2.8.19.14"
-description = "Typing stubs for python-dateutil"
-category = "main"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "uri-template"
-version = "1.3.0"
-description = "RFC 6570 URI Template Processor"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.extras]
-dev = ["flake8", "flake8-annotations", "flake8-bandit", "flake8-bugbear", "flake8-commas", "flake8-comprehensions", "flake8-continuation", "flake8-datetimez", "flake8-docstrings", "flake8-import-order", "flake8-literal", "flake8-modern-annotations", "flake8-noqa", "flake8-pyproject", "flake8-requirements", "flake8-typechecking-import", "flake8-use-fstring", "mypy", "pep8-naming", "types-pyyaml"]
-
-[[package]]
-name = "webcolors"
-version = "1.13"
-description = "A library for working with the color formats defined by HTML and CSS."
-category = "main"
-optional = false
-python-versions = ">=3.7"
-
-[package.extras]
-docs = ["furo", "sphinx", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-notfound-page", "sphinxext-opengraph"]
-tests = ["pytest", "pytest-cov"]
-
-[metadata]
-lock-version = "1.1"
-python-versions = "^3.11"
-content-hash = "39fdd5b51aad80a920425e37435377431d02f1018a69ab4f43e35eb1870b0aca"
-
-[metadata.files]
-arrow = []
-attrs = [
-    {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"},
-    {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"},
-]
-"boolean.py" = []
-cyclonedx-python-lib = []
-ddt = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-defusedxml = []
-fqdn = []
-idna = [
-    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
-    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
-]
-isoduration = []
-jsonpointer = []
-jsonschema = []
-jsonschema-specifications = []
-license-expression = []
-lxml = []
-packageurl-python = []
-py-serializable = []
-python-dateutil = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
-]
-referencing = []
-rfc3339-validator = []
-rfc3987 = []
-rpds-py = []
-six = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-sortedcontainers = [
-    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
-    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
-]
-types-python-dateutil = []
-uri-template = []
-webcolors = []
diff --git a/tests/_data/infiles/poetry/more-deps-2.0-poetry.lock b/tests/_data/infiles/poetry/more-deps-2.0-poetry.lock
deleted file mode 100644
index 08a9bbbd..00000000
--- a/tests/_data/infiles/poetry/more-deps-2.0-poetry.lock
+++ /dev/null
@@ -1,570 +0,0 @@
-# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
-
-[[package]]
-name = "arrow"
-version = "1.3.0"
-description = "Better dates & times for Python"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
-    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
-]
-
-[package.dependencies]
-python-dateutil = ">=2.7.0"
-types-python-dateutil = ">=2.8.10"
-
-[package.extras]
-doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
-test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
-
-[[package]]
-name = "attrs"
-version = "23.1.0"
-description = "Classes Without Boilerplate"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"},
-    {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"},
-]
-
-[package.extras]
-cov = ["attrs[tests]", "coverage[toml] (>=5.3)"]
-dev = ["attrs[docs,tests]", "pre-commit"]
-docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"]
-tests = ["attrs[tests-no-zope]", "zope-interface"]
-tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
-
-[[package]]
-name = "boolean-py"
-version = "4.0"
-description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
-optional = false
-python-versions = "*"
-files = [
-    {file = "boolean.py-4.0-py3-none-any.whl", hash = "sha256:2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"},
-    {file = "boolean.py-4.0.tar.gz", hash = "sha256:17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"},
-]
-
-[[package]]
-name = "cyclonedx-python-lib"
-version = "5.1.1"
-description = "Python library for CycloneDX"
-optional = false
-python-versions = ">=3.8,<4.0"
-files = [
-    {file = "cyclonedx_python_lib-5.1.1-py3-none-any.whl", hash = "sha256:2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"},
-    {file = "cyclonedx_python_lib-5.1.1.tar.gz", hash = "sha256:215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"},
-]
-
-[package.dependencies]
-jsonschema = {version = ">=4.18,<5.0", extras = ["format"], optional = true, markers = "extra == \"validation\" or extra == \"json-validation\""}
-license-expression = ">=30,<31"
-lxml = {version = ">=4,<5", optional = true, markers = "extra == \"validation\" or extra == \"xml-validation\""}
-packageurl-python = ">=0.11"
-py-serializable = ">=0.15,<0.16"
-sortedcontainers = ">=2.4.0,<3.0.0"
-
-[package.extras]
-json-validation = ["jsonschema[format] (>=4.18,<5.0)"]
-validation = ["jsonschema[format] (>=4.18,<5.0)", "lxml (>=4,<5)"]
-xml-validation = ["lxml (>=4,<5)"]
-
-[[package]]
-name = "ddt"
-version = "1.6.0"
-description = "Data-Driven/Decorated Tests"
-optional = false
-python-versions = "*"
-files = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-
-[[package]]
-name = "defusedxml"
-version = "0.7.1"
-description = "XML bomb protection for Python stdlib modules"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-files = [
-    {file = "defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"},
-    {file = "defusedxml-0.7.1.tar.gz", hash = "sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"},
-]
-
-[[package]]
-name = "fqdn"
-version = "1.5.1"
-description = "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers"
-optional = false
-python-versions = ">=2.7, !=3.0, !=3.1, !=3.2, !=3.3, !=3.4, <4"
-files = [
-    {file = "fqdn-1.5.1-py3-none-any.whl", hash = "sha256:3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"},
-    {file = "fqdn-1.5.1.tar.gz", hash = "sha256:105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"},
-]
-
-[[package]]
-name = "idna"
-version = "3.4"
-description = "Internationalized Domain Names in Applications (IDNA)"
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
-    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
-]
-
-[[package]]
-name = "isoduration"
-version = "20.11.0"
-description = "Operations with ISO 8601 durations"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
-    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
-]
-
-[package.dependencies]
-arrow = ">=0.15.0"
-
-[[package]]
-name = "jsonpointer"
-version = "2.4"
-description = "Identify specific nodes in a JSON document (RFC 6901)"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*, !=3.6.*"
-files = [
-    {file = "jsonpointer-2.4-py2.py3-none-any.whl", hash = "sha256:15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"},
-    {file = "jsonpointer-2.4.tar.gz", hash = "sha256:585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"},
-]
-
-[[package]]
-name = "jsonschema"
-version = "4.19.2"
-description = "An implementation of JSON Schema validation for Python"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "jsonschema-4.19.2-py3-none-any.whl", hash = "sha256:eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"},
-    {file = "jsonschema-4.19.2.tar.gz", hash = "sha256:c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"},
-]
-
-[package.dependencies]
-attrs = ">=22.2.0"
-fqdn = {version = "*", optional = true, markers = "extra == \"format\""}
-idna = {version = "*", optional = true, markers = "extra == \"format\""}
-isoduration = {version = "*", optional = true, markers = "extra == \"format\""}
-jsonpointer = {version = ">1.13", optional = true, markers = "extra == \"format\""}
-jsonschema-specifications = ">=2023.03.6"
-referencing = ">=0.28.4"
-rfc3339-validator = {version = "*", optional = true, markers = "extra == \"format\""}
-rfc3987 = {version = "*", optional = true, markers = "extra == \"format\""}
-rpds-py = ">=0.7.1"
-uri-template = {version = "*", optional = true, markers = "extra == \"format\""}
-webcolors = {version = ">=1.11", optional = true, markers = "extra == \"format\""}
-
-[package.extras]
-format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
-format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3986-validator (>0.1.0)", "uri-template", "webcolors (>=1.11)"]
-
-[[package]]
-name = "jsonschema-specifications"
-version = "2023.7.1"
-description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "jsonschema_specifications-2023.7.1-py3-none-any.whl", hash = "sha256:05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"},
-    {file = "jsonschema_specifications-2023.7.1.tar.gz", hash = "sha256:c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"},
-]
-
-[package.dependencies]
-referencing = ">=0.28.0"
-
-[[package]]
-name = "license-expression"
-version = "30.1.1"
-description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "license-expression-30.1.1.tar.gz", hash = "sha256:42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"},
-    {file = "license_expression-30.1.1-py3-none-any.whl", hash = "sha256:8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"},
-]
-
-[package.dependencies]
-"boolean.py" = ">=4.0"
-
-[package.extras]
-docs = ["Sphinx (==5.1.0)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)"]
-testing = ["black", "isort", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)", "twine"]
-
-[[package]]
-name = "lxml"
-version = "4.9.3"
-description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
-files = [
-    {file = "lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl", hash = "sha256:b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"},
-    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"},
-    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"},
-    {file = "lxml-4.9.3-cp27-cp27m-win32.whl", hash = "sha256:2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"},
-    {file = "lxml-4.9.3-cp27-cp27m-win_amd64.whl", hash = "sha256:4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"},
-    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"},
-    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"},
-    {file = "lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"},
-    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"},
-    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"},
-    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"},
-    {file = "lxml-4.9.3-cp310-cp310-win32.whl", hash = "sha256:cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"},
-    {file = "lxml-4.9.3-cp310-cp310-win_amd64.whl", hash = "sha256:97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"},
-    {file = "lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"},
-    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"},
-    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"},
-    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"},
-    {file = "lxml-4.9.3-cp311-cp311-win32.whl", hash = "sha256:0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"},
-    {file = "lxml-4.9.3-cp311-cp311-win_amd64.whl", hash = "sha256:25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"},
-    {file = "lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"},
-    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"},
-    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"},
-    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"},
-    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"},
-    {file = "lxml-4.9.3-cp312-cp312-win_amd64.whl", hash = "sha256:d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"},
-    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"},
-    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"},
-    {file = "lxml-4.9.3-cp35-cp35m-win32.whl", hash = "sha256:704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"},
-    {file = "lxml-4.9.3-cp35-cp35m-win_amd64.whl", hash = "sha256:c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"},
-    {file = "lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl", hash = "sha256:64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl", hash = "sha256:4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"},
-    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"},
-    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl", hash = "sha256:0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"},
-    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl", hash = "sha256:aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"},
-    {file = "lxml-4.9.3-cp36-cp36m-win32.whl", hash = "sha256:50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"},
-    {file = "lxml-4.9.3-cp36-cp36m-win_amd64.whl", hash = "sha256:bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl", hash = "sha256:53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"},
-    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"},
-    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"},
-    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"},
-    {file = "lxml-4.9.3-cp37-cp37m-win32.whl", hash = "sha256:1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"},
-    {file = "lxml-4.9.3-cp37-cp37m-win_amd64.whl", hash = "sha256:120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl", hash = "sha256:6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"},
-    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"},
-    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"},
-    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"},
-    {file = "lxml-4.9.3-cp38-cp38-win32.whl", hash = "sha256:57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"},
-    {file = "lxml-4.9.3-cp38-cp38-win_amd64.whl", hash = "sha256:92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"},
-    {file = "lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl", hash = "sha256:9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl", hash = "sha256:303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl", hash = "sha256:5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"},
-    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"},
-    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"},
-    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"},
-    {file = "lxml-4.9.3-cp39-cp39-win32.whl", hash = "sha256:8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"},
-    {file = "lxml-4.9.3-cp39-cp39-win_amd64.whl", hash = "sha256:4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"},
-    {file = "lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"},
-    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"},
-    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"},
-    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl", hash = "sha256:5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"},
-    {file = "lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl", hash = "sha256:ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"},
-    {file = "lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"},
-    {file = "lxml-4.9.3.tar.gz", hash = "sha256:48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"},
-]
-
-[package.extras]
-cssselect = ["cssselect (>=0.7)"]
-html5 = ["html5lib"]
-htmlsoup = ["BeautifulSoup4"]
-source = ["Cython (>=0.29.35)"]
-
-[[package]]
-name = "packageurl-python"
-version = "0.11.2"
-description = "A purl aka. Package URL parser and builder"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "packageurl-python-0.11.2.tar.gz", hash = "sha256:01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"},
-    {file = "packageurl_python-0.11.2-py3-none-any.whl", hash = "sha256:799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"},
-]
-
-[package.extras]
-build = ["wheel"]
-lint = ["black", "isort", "mypy"]
-sqlalchemy = ["sqlalchemy (>=2.0.0)"]
-test = ["pytest"]
-
-[[package]]
-name = "py-serializable"
-version = "0.15.0"
-description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
-optional = false
-python-versions = ">=3.7,<4.0"
-files = [
-    {file = "py-serializable-0.15.0.tar.gz", hash = "sha256:8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"},
-    {file = "py_serializable-0.15.0-py3-none-any.whl", hash = "sha256:d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"},
-]
-
-[package.dependencies]
-defusedxml = ">=0.7.1,<0.8.0"
-
-[[package]]
-name = "python-dateutil"
-version = "2.8.2"
-description = "Extensions to the standard Python datetime module"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-files = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
-]
-
-[package.dependencies]
-six = ">=1.5"
-
-[[package]]
-name = "referencing"
-version = "0.30.2"
-description = "JSON Referencing + Python"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "referencing-0.30.2-py3-none-any.whl", hash = "sha256:449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"},
-    {file = "referencing-0.30.2.tar.gz", hash = "sha256:794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"},
-]
-
-[package.dependencies]
-attrs = ">=22.2.0"
-rpds-py = ">=0.7.0"
-
-[[package]]
-name = "rfc3339-validator"
-version = "0.1.4"
-description = "A pure python RFC3339 validator"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
-files = [
-    {file = "rfc3339_validator-0.1.4-py2.py3-none-any.whl", hash = "sha256:24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"},
-    {file = "rfc3339_validator-0.1.4.tar.gz", hash = "sha256:138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"},
-]
-
-[package.dependencies]
-six = "*"
-
-[[package]]
-name = "rfc3987"
-version = "1.3.8"
-description = "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)"
-optional = false
-python-versions = "*"
-files = [
-    {file = "rfc3987-1.3.8-py2.py3-none-any.whl", hash = "sha256:10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"},
-    {file = "rfc3987-1.3.8.tar.gz", hash = "sha256:d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"},
-]
-
-[[package]]
-name = "rpds-py"
-version = "0.12.0"
-description = "Python bindings to Rust's persistent data structures (rpds)"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl", hash = "sha256:c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"},
-    {file = "rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"},
-    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"},
-    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"},
-    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"},
-    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"},
-    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"},
-    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"},
-    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"},
-    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"},
-    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"},
-    {file = "rpds_py-0.12.0-cp310-none-win32.whl", hash = "sha256:7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"},
-    {file = "rpds_py-0.12.0-cp310-none-win_amd64.whl", hash = "sha256:1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"},
-    {file = "rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl", hash = "sha256:0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"},
-    {file = "rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"},
-    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"},
-    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"},
-    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"},
-    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"},
-    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"},
-    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"},
-    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"},
-    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"},
-    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"},
-    {file = "rpds_py-0.12.0-cp311-none-win32.whl", hash = "sha256:dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"},
-    {file = "rpds_py-0.12.0-cp311-none-win_amd64.whl", hash = "sha256:c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"},
-    {file = "rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl", hash = "sha256:9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"},
-    {file = "rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"},
-    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"},
-    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"},
-    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"},
-    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"},
-    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"},
-    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"},
-    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"},
-    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"},
-    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"},
-    {file = "rpds_py-0.12.0-cp312-none-win32.whl", hash = "sha256:b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"},
-    {file = "rpds_py-0.12.0-cp312-none-win_amd64.whl", hash = "sha256:8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"},
-    {file = "rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl", hash = "sha256:6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"},
-    {file = "rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"},
-    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"},
-    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"},
-    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"},
-    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"},
-    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"},
-    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"},
-    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"},
-    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"},
-    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"},
-    {file = "rpds_py-0.12.0-cp38-none-win32.whl", hash = "sha256:e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"},
-    {file = "rpds_py-0.12.0-cp38-none-win_amd64.whl", hash = "sha256:bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"},
-    {file = "rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl", hash = "sha256:1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"},
-    {file = "rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"},
-    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"},
-    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"},
-    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"},
-    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"},
-    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"},
-    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"},
-    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"},
-    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"},
-    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"},
-    {file = "rpds_py-0.12.0-cp39-none-win32.whl", hash = "sha256:b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"},
-    {file = "rpds_py-0.12.0-cp39-none-win_amd64.whl", hash = "sha256:cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl", hash = "sha256:e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"},
-    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl", hash = "sha256:513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl", hash = "sha256:1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"},
-    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl", hash = "sha256:466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl", hash = "sha256:6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"},
-    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"},
-    {file = "rpds_py-0.12.0.tar.gz", hash = "sha256:7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"},
-]
-
-[[package]]
-name = "six"
-version = "1.16.0"
-description = "Python 2 and 3 compatibility utilities"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-
-[[package]]
-name = "sortedcontainers"
-version = "2.4.0"
-description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
-optional = false
-python-versions = "*"
-files = [
-    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
-    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
-]
-
-[[package]]
-name = "types-python-dateutil"
-version = "2.8.19.14"
-description = "Typing stubs for python-dateutil"
-optional = false
-python-versions = "*"
-files = [
-    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
-    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
-]
-
-[[package]]
-name = "uri-template"
-version = "1.3.0"
-description = "RFC 6570 URI Template Processor"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "uri-template-1.3.0.tar.gz", hash = "sha256:0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"},
-    {file = "uri_template-1.3.0-py3-none-any.whl", hash = "sha256:a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"},
-]
-
-[package.extras]
-dev = ["flake8", "flake8-annotations", "flake8-bandit", "flake8-bugbear", "flake8-commas", "flake8-comprehensions", "flake8-continuation", "flake8-datetimez", "flake8-docstrings", "flake8-import-order", "flake8-literal", "flake8-modern-annotations", "flake8-noqa", "flake8-pyproject", "flake8-requirements", "flake8-typechecking-import", "flake8-use-fstring", "mypy", "pep8-naming", "types-PyYAML"]
-
-[[package]]
-name = "webcolors"
-version = "1.13"
-description = "A library for working with the color formats defined by HTML and CSS."
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "webcolors-1.13-py3-none-any.whl", hash = "sha256:29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"},
-    {file = "webcolors-1.13.tar.gz", hash = "sha256:c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"},
-]
-
-[package.extras]
-docs = ["furo", "sphinx", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-notfound-page", "sphinxext-opengraph"]
-tests = ["pytest", "pytest-cov"]
-
-[metadata]
-lock-version = "2.0"
-python-versions = "^3.11"
-content-hash = "39fdd5b51aad80a920425e37435377431d02f1018a69ab4f43e35eb1870b0aca"
diff --git a/tests/_data/infiles/poetry/more-deps-pyproject.toml b/tests/_data/infiles/poetry/more-deps-pyproject.toml
deleted file mode 100644
index 22c93593..00000000
--- a/tests/_data/infiles/poetry/more-deps-pyproject.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[tool.poetry]
-name = "more-deps"
-version = "0.1.0"
-description = "dependencies, extras, transitive dependencies"
-authors = ["Your Name <you@example.com>"]
-
-[tool.poetry.dependencies]
-python = "^3.11"
-cyclonedx-python-lib = {extras = ["validation"], version = "^5.1.1"}
-
-[tool.poetry.dev-dependencies]
-isoduration = "^20.11.0"
-ddt = "^1.6.0"
-
-[build-system]
-requires = ["poetry>=0.12"]
-build-backend = "poetry.masonry.api"
diff --git a/tests/_data/infiles/poetry/simple-pyproject.toml b/tests/_data/infiles/poetry/regression-issue611/pyproject.toml
similarity index 64%
rename from tests/_data/infiles/poetry/simple-pyproject.toml
rename to tests/_data/infiles/poetry/regression-issue611/pyproject.toml
index 7fb9c6d6..f27c4e41 100644
--- a/tests/_data/infiles/poetry/simple-pyproject.toml
+++ b/tests/_data/infiles/poetry/regression-issue611/pyproject.toml
@@ -1,16 +1,13 @@
 [tool.poetry]
-name = "simple"
+name = "regression-issue611"
 version = "0.1.0"
-description = "a simple set of dependnecies"
+description = "regression for issue #611"
 authors = ["Your Name <you@example.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
 python = "^3.11"
-toml = "^0.10.2"
-
-[tool.poetry.dev-dependencies]
-ddt = "^1.6.0"
+pyhumps = "3.7.1"
 
 [build-system]
 requires = ["poetry-core"]
diff --git a/tests/_data/infiles/poetry/regression-issue611-poetry.lock.bin b/tests/_data/infiles/poetry/regression-issue611/regression-issue611-poetry.lock.bin
similarity index 100%
rename from tests/_data/infiles/poetry/regression-issue611-poetry.lock.bin
rename to tests/_data/infiles/poetry/regression-issue611/regression-issue611-poetry.lock.bin
diff --git a/tests/_data/infiles/poetry/simple-1.0-poetry.lock b/tests/_data/infiles/poetry/simple-1.0-poetry.lock
deleted file mode 100644
index 3850690d..00000000
--- a/tests/_data/infiles/poetry/simple-1.0-poetry.lock
+++ /dev/null
@@ -1,30 +0,0 @@
-[[package]]
-category = "dev"
-description = "Data-Driven/Decorated Tests"
-name = "ddt"
-optional = false
-python-versions = "*"
-version = "1.6.0"
-
-[[package]]
-category = "main"
-description = "Python Library for Tom's Obvious, Minimal Language"
-name = "toml"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-version = "0.10.2"
-
-[metadata]
-content-hash = "c6714ac009c7394dbcba37e864e27f1341e55be360c97e7f66d3538ceb8eb14f"
-lock-version = "1.0"
-python-versions = "^3.11"
-
-[metadata.files]
-ddt = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-toml = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
diff --git a/tests/_data/infiles/poetry/simple-1.1-poetry.lock b/tests/_data/infiles/poetry/simple-1.1-poetry.lock
deleted file mode 100644
index 79add0a7..00000000
--- a/tests/_data/infiles/poetry/simple-1.1-poetry.lock
+++ /dev/null
@@ -1,30 +0,0 @@
-[[package]]
-name = "ddt"
-version = "1.6.0"
-description = "Data-Driven/Decorated Tests"
-category = "dev"
-optional = false
-python-versions = "*"
-
-[[package]]
-name = "toml"
-version = "0.10.2"
-description = "Python Library for Tom's Obvious, Minimal Language"
-category = "main"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-
-[metadata]
-lock-version = "1.1"
-python-versions = "^3.11"
-content-hash = "c6714ac009c7394dbcba37e864e27f1341e55be360c97e7f66d3538ceb8eb14f"
-
-[metadata.files]
-ddt = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-toml = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
diff --git a/tests/_data/infiles/poetry/simple-2.0-poetry.lock b/tests/_data/infiles/poetry/simple-2.0-poetry.lock
deleted file mode 100644
index 37c23723..00000000
--- a/tests/_data/infiles/poetry/simple-2.0-poetry.lock
+++ /dev/null
@@ -1,30 +0,0 @@
-# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand.
-
-[[package]]
-name = "ddt"
-version = "1.6.0"
-description = "Data-Driven/Decorated Tests"
-category = "dev"
-optional = false
-python-versions = "*"
-files = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
-]
-
-[[package]]
-name = "toml"
-version = "0.10.2"
-description = "Python Library for Tom's Obvious, Minimal Language"
-category = "main"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
-
-[metadata]
-lock-version = "2.0"
-python-versions = "^3.11"
-content-hash = "c6714ac009c7394dbcba37e864e27f1341e55be360c97e7f66d3538ceb8eb14f"
diff --git a/tests/_data/infiles/requirements/with-urls.txt b/tests/_data/infiles/requirements/with-urls.txt
index 0e34d0a9..c17d92b6 100644
--- a/tests/_data/infiles/requirements/with-urls.txt
+++ b/tests/_data/infiles/requirements/with-urls.txt
@@ -1,21 +1,23 @@
+# dependencies from urls
 
-# VCS
-## commit hash
+## VCS
+### commit hash
 git+https://github.com/path/to/package-one@41b95ec#egg=package-one
-## master branch
+### master branch
 git+https://github.com/path/to/package-two@master#egg=package-two
-## tag
+### tag
 git+https://github.com/path/to/package-three@0.1#egg=package-three
-## release tag
+### release tag
 git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four
 
 
-# http build dist
+## http build dist
 http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl
 
-# http source dist
+
+## http source dist
 https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz
 
 
-# named repo ref
+## named fetchable file
 urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index 507a3485..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,61 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index e7aea997..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,53 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index 96daf340..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,107 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index 6eea85e4..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,72 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="toml@0.10.2"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index 82bebf48..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,155 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "name": "colorama",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index f0fade9d..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,96 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="toml@0.10.2"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index af327034..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,189 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "name": "colorama",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index a6a6dec2..00000000
--- a/tests/_data/snapshots/poetry/group-deps-1.1-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,122 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="toml@0.10.2"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index 507a3485..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,61 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index eb5b32c3..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,133 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index 65f19be7..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,203 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "externalReferences": [
-        {
-          "comment": "file: arrow-1.3.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        },
-        {
-          "comment": "file: arrow-1.3.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        }
-      ],
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "externalReferences": [
-        {
-          "comment": "file: colorama-0.4.6-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/colorama/0.4.6"
-        },
-        {
-          "comment": "file: colorama-0.4.6.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/colorama/0.4.6"
-        }
-      ],
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "externalReferences": [
-        {
-          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        },
-        {
-          "comment": "file: isoduration-20.11.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        }
-      ],
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "externalReferences": [
-        {
-          "comment": "file: python-dateutil-2.8.2.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        },
-        {
-          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        }
-      ],
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "externalReferences": [
-        {
-          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        },
-        {
-          "comment": "file: six-1.16.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        }
-      ],
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "externalReferences": [
-        {
-          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        },
-        {
-          "comment": "file: toml-0.10.2.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        }
-      ],
-      "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "externalReferences": [
-        {
-          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        },
-        {
-          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        }
-      ],
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index 7de91d2d..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,152 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="toml@0.10.2"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index c90c1504..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,299 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "externalReferences": [
-        {
-          "comment": "file: arrow-1.3.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        },
-        {
-          "comment": "file: arrow-1.3.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        }
-      ],
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "externalReferences": [
-        {
-          "comment": "file: colorama-0.4.6-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/colorama/0.4.6"
-        },
-        {
-          "comment": "file: colorama-0.4.6.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/colorama/0.4.6"
-        }
-      ],
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "externalReferences": [
-        {
-          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        },
-        {
-          "comment": "file: isoduration-20.11.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        }
-      ],
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "externalReferences": [
-        {
-          "comment": "file: python-dateutil-2.8.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        },
-        {
-          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        }
-      ],
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "externalReferences": [
-        {
-          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        },
-        {
-          "comment": "file: six-1.16.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        }
-      ],
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "externalReferences": [
-        {
-          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        },
-        {
-          "comment": "file: toml-0.10.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        }
-      ],
-      "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "externalReferences": [
-        {
-          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        },
-        {
-          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        }
-      ],
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index b46ea576..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,200 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="toml@0.10.2"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index 595c4d3d..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,333 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "externalReferences": [
-        {
-          "comment": "file: arrow-1.3.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        },
-        {
-          "comment": "file: arrow-1.3.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        }
-      ],
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "externalReferences": [
-        {
-          "comment": "file: colorama-0.4.6-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/colorama/0.4.6"
-        },
-        {
-          "comment": "file: colorama-0.4.6.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/colorama/0.4.6"
-        }
-      ],
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "externalReferences": [
-        {
-          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        },
-        {
-          "comment": "file: isoduration-20.11.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        }
-      ],
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "externalReferences": [
-        {
-          "comment": "file: python-dateutil-2.8.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        },
-        {
-          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        }
-      ],
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "externalReferences": [
-        {
-          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        },
-        {
-          "comment": "file: six-1.16.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        }
-      ],
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "externalReferences": [
-        {
-          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        },
-        {
-          "comment": "file: toml-0.10.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        }
-      ],
-      "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "externalReferences": [
-        {
-          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        },
-        {
-          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        }
-      ],
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index 2bee886b..00000000
--- a/tests/_data/snapshots/poetry/group-deps-2.0-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,226 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/colorama/0.4.6</url>
-          <comment>file: colorama-0.4.6.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="toml@0.10.2"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index 29e63285..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,96 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index c2939c5f..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,83 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index 51f14571..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,162 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "boolean.py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "name": "boolean.py",
-      "purl": "pkg:pypi/boolean.py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "name": "cyclonedx-python-lib",
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "name": "defusedxml",
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "name": "license-expression",
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "name": "py-serializable",
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "name": "sortedcontainers",
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "boolean.py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index dff61b85..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,107 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="boolean.py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index 67e475d9..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,240 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "boolean.py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "name": "boolean.py",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/boolean.py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "name": "cyclonedx-python-lib",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "name": "defusedxml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "name": "license-expression",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "name": "packageurl-python",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "name": "py-serializable",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "name": "sortedcontainers",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "boolean.py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index adcbca1a..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,146 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="boolean.py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index fd0adb72..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,274 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "boolean.py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "name": "boolean.py",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/boolean.py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "name": "cyclonedx-python-lib",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "name": "defusedxml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "name": "license-expression",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "name": "packageurl-python",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "name": "py-serializable",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "name": "sortedcontainers",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "boolean.py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index 2702933c..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.0-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,172 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="boolean.py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index 4b3514f2..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,187 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index 19582690..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,161 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index e54bfb03..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,305 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "attrs@23.1.0",
-      "description": "Classes Without Boilerplate",
-      "name": "attrs",
-      "purl": "pkg:pypi/attrs@23.1.0",
-      "type": "library",
-      "version": "23.1.0"
-    },
-    {
-      "bom-ref": "boolean.py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "name": "boolean.py",
-      "purl": "pkg:pypi/boolean.py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "name": "cyclonedx-python-lib",
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "name": "defusedxml",
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "fqdn@1.5.1",
-      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
-      "name": "fqdn",
-      "purl": "pkg:pypi/fqdn@1.5.1",
-      "type": "library",
-      "version": "1.5.1"
-    },
-    {
-      "bom-ref": "idna@3.4",
-      "description": "Internationalized Domain Names in Applications (IDNA)",
-      "name": "idna",
-      "purl": "pkg:pypi/idna@3.4",
-      "type": "library",
-      "version": "3.4"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "jsonpointer@2.4",
-      "description": "Identify specific nodes in a JSON document (RFC 6901)",
-      "name": "jsonpointer",
-      "purl": "pkg:pypi/jsonpointer@2.4",
-      "type": "library",
-      "version": "2.4"
-    },
-    {
-      "bom-ref": "jsonschema@4.19.2",
-      "description": "An implementation of JSON Schema validation for Python",
-      "name": "jsonschema",
-      "purl": "pkg:pypi/jsonschema@4.19.2",
-      "type": "library",
-      "version": "4.19.2"
-    },
-    {
-      "bom-ref": "jsonschema-specifications@2023.7.1",
-      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
-      "name": "jsonschema-specifications",
-      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
-      "type": "library",
-      "version": "2023.7.1"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "name": "license-expression",
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "lxml@4.9.3",
-      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
-      "name": "lxml",
-      "purl": "pkg:pypi/lxml@4.9.3",
-      "type": "library",
-      "version": "4.9.3"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "name": "py-serializable",
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "referencing@0.30.2",
-      "description": "JSON Referencing + Python",
-      "name": "referencing",
-      "purl": "pkg:pypi/referencing@0.30.2",
-      "type": "library",
-      "version": "0.30.2"
-    },
-    {
-      "bom-ref": "rfc3339-validator@0.1.4",
-      "description": "A pure python RFC3339 validator",
-      "name": "rfc3339-validator",
-      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
-      "type": "library",
-      "version": "0.1.4"
-    },
-    {
-      "bom-ref": "rfc3987@1.3.8",
-      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
-      "name": "rfc3987",
-      "purl": "pkg:pypi/rfc3987@1.3.8",
-      "type": "library",
-      "version": "1.3.8"
-    },
-    {
-      "bom-ref": "rpds-py@0.12.0",
-      "description": "Python bindings to Rust's persistent data structures (rpds)",
-      "name": "rpds-py",
-      "purl": "pkg:pypi/rpds-py@0.12.0",
-      "type": "library",
-      "version": "0.12.0"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "name": "sortedcontainers",
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    },
-    {
-      "bom-ref": "uri-template@1.3.0",
-      "description": "RFC 6570 URI Template Processor",
-      "name": "uri-template",
-      "purl": "pkg:pypi/uri-template@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "webcolors@1.13",
-      "description": "A library for working with the color formats defined by HTML and CSS.",
-      "name": "webcolors",
-      "purl": "pkg:pypi/webcolors@1.13",
-      "type": "library",
-      "version": "1.13"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "attrs@23.1.0"
-    },
-    {
-      "ref": "boolean.py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "fqdn@1.5.1"
-    },
-    {
-      "ref": "idna@3.4"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "jsonpointer@2.4"
-    },
-    {
-      "ref": "jsonschema-specifications@2023.7.1"
-    },
-    {
-      "ref": "jsonschema@4.19.2"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "lxml@4.9.3"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "referencing@0.30.2"
-    },
-    {
-      "ref": "rfc3339-validator@0.1.4"
-    },
-    {
-      "ref": "rfc3987@1.3.8"
-    },
-    {
-      "ref": "rpds-py@0.12.0"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    },
-    {
-      "ref": "uri-template@1.3.0"
-    },
-    {
-      "ref": "webcolors@1.13"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index fa96b253..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,198 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="attrs@23.1.0"/>
-    <dependency ref="boolean.py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="fqdn@1.5.1"/>
-    <dependency ref="idna@3.4"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="jsonpointer@2.4"/>
-    <dependency ref="jsonschema-specifications@2023.7.1"/>
-    <dependency ref="jsonschema@4.19.2"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="lxml@4.9.3"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="referencing@0.30.2"/>
-    <dependency ref="rfc3339-validator@0.1.4"/>
-    <dependency ref="rfc3987@1.3.8"/>
-    <dependency ref="rpds-py@0.12.0"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-    <dependency ref="uri-template@1.3.0"/>
-    <dependency ref="webcolors@1.13"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index 4c359d4c..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,461 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "attrs@23.1.0",
-      "description": "Classes Without Boilerplate",
-      "name": "attrs",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/attrs@23.1.0",
-      "type": "library",
-      "version": "23.1.0"
-    },
-    {
-      "bom-ref": "boolean.py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "name": "boolean.py",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/boolean.py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "name": "cyclonedx-python-lib",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "name": "defusedxml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "fqdn@1.5.1",
-      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
-      "name": "fqdn",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/fqdn@1.5.1",
-      "type": "library",
-      "version": "1.5.1"
-    },
-    {
-      "bom-ref": "idna@3.4",
-      "description": "Internationalized Domain Names in Applications (IDNA)",
-      "name": "idna",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/idna@3.4",
-      "type": "library",
-      "version": "3.4"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "jsonpointer@2.4",
-      "description": "Identify specific nodes in a JSON document (RFC 6901)",
-      "name": "jsonpointer",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/jsonpointer@2.4",
-      "type": "library",
-      "version": "2.4"
-    },
-    {
-      "bom-ref": "jsonschema@4.19.2",
-      "description": "An implementation of JSON Schema validation for Python",
-      "name": "jsonschema",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/jsonschema@4.19.2",
-      "type": "library",
-      "version": "4.19.2"
-    },
-    {
-      "bom-ref": "jsonschema-specifications@2023.7.1",
-      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
-      "name": "jsonschema-specifications",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
-      "type": "library",
-      "version": "2023.7.1"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "name": "license-expression",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "lxml@4.9.3",
-      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
-      "name": "lxml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/lxml@4.9.3",
-      "type": "library",
-      "version": "4.9.3"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "name": "packageurl-python",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "name": "py-serializable",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "referencing@0.30.2",
-      "description": "JSON Referencing + Python",
-      "name": "referencing",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/referencing@0.30.2",
-      "type": "library",
-      "version": "0.30.2"
-    },
-    {
-      "bom-ref": "rfc3339-validator@0.1.4",
-      "description": "A pure python RFC3339 validator",
-      "name": "rfc3339-validator",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
-      "type": "library",
-      "version": "0.1.4"
-    },
-    {
-      "bom-ref": "rfc3987@1.3.8",
-      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
-      "name": "rfc3987",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/rfc3987@1.3.8",
-      "type": "library",
-      "version": "1.3.8"
-    },
-    {
-      "bom-ref": "rpds-py@0.12.0",
-      "description": "Python bindings to Rust's persistent data structures (rpds)",
-      "name": "rpds-py",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/rpds-py@0.12.0",
-      "type": "library",
-      "version": "0.12.0"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "name": "sortedcontainers",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    },
-    {
-      "bom-ref": "uri-template@1.3.0",
-      "description": "RFC 6570 URI Template Processor",
-      "name": "uri-template",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/uri-template@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "webcolors@1.13",
-      "description": "A library for working with the color formats defined by HTML and CSS.",
-      "name": "webcolors",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/webcolors@1.13",
-      "type": "library",
-      "version": "1.13"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "attrs@23.1.0"
-    },
-    {
-      "ref": "boolean.py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "fqdn@1.5.1"
-    },
-    {
-      "ref": "idna@3.4"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "jsonpointer@2.4"
-    },
-    {
-      "ref": "jsonschema-specifications@2023.7.1"
-    },
-    {
-      "ref": "jsonschema@4.19.2"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "lxml@4.9.3"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "referencing@0.30.2"
-    },
-    {
-      "ref": "rfc3339-validator@0.1.4"
-    },
-    {
-      "ref": "rfc3987@1.3.8"
-    },
-    {
-      "ref": "rpds-py@0.12.0"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    },
-    {
-      "ref": "uri-template@1.3.0"
-    },
-    {
-      "ref": "webcolors@1.13"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index 3312638e..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,276 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="attrs@23.1.0"/>
-    <dependency ref="boolean.py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="fqdn@1.5.1"/>
-    <dependency ref="idna@3.4"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="jsonpointer@2.4"/>
-    <dependency ref="jsonschema-specifications@2023.7.1"/>
-    <dependency ref="jsonschema@4.19.2"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="lxml@4.9.3"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="referencing@0.30.2"/>
-    <dependency ref="rfc3339-validator@0.1.4"/>
-    <dependency ref="rfc3987@1.3.8"/>
-    <dependency ref="rpds-py@0.12.0"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-    <dependency ref="uri-template@1.3.0"/>
-    <dependency ref="webcolors@1.13"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index cbd17ba2..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,495 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "attrs@23.1.0",
-      "description": "Classes Without Boilerplate",
-      "name": "attrs",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/attrs@23.1.0",
-      "type": "library",
-      "version": "23.1.0"
-    },
-    {
-      "bom-ref": "boolean.py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "name": "boolean.py",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/boolean.py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "name": "cyclonedx-python-lib",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "name": "defusedxml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "fqdn@1.5.1",
-      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
-      "name": "fqdn",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/fqdn@1.5.1",
-      "type": "library",
-      "version": "1.5.1"
-    },
-    {
-      "bom-ref": "idna@3.4",
-      "description": "Internationalized Domain Names in Applications (IDNA)",
-      "name": "idna",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/idna@3.4",
-      "type": "library",
-      "version": "3.4"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "name": "isoduration",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "jsonpointer@2.4",
-      "description": "Identify specific nodes in a JSON document (RFC 6901)",
-      "name": "jsonpointer",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/jsonpointer@2.4",
-      "type": "library",
-      "version": "2.4"
-    },
-    {
-      "bom-ref": "jsonschema@4.19.2",
-      "description": "An implementation of JSON Schema validation for Python",
-      "name": "jsonschema",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/jsonschema@4.19.2",
-      "type": "library",
-      "version": "4.19.2"
-    },
-    {
-      "bom-ref": "jsonschema-specifications@2023.7.1",
-      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
-      "name": "jsonschema-specifications",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
-      "type": "library",
-      "version": "2023.7.1"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "name": "license-expression",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "lxml@4.9.3",
-      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
-      "name": "lxml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/lxml@4.9.3",
-      "type": "library",
-      "version": "4.9.3"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "name": "packageurl-python",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "name": "py-serializable",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "referencing@0.30.2",
-      "description": "JSON Referencing + Python",
-      "name": "referencing",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/referencing@0.30.2",
-      "type": "library",
-      "version": "0.30.2"
-    },
-    {
-      "bom-ref": "rfc3339-validator@0.1.4",
-      "description": "A pure python RFC3339 validator",
-      "name": "rfc3339-validator",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
-      "type": "library",
-      "version": "0.1.4"
-    },
-    {
-      "bom-ref": "rfc3987@1.3.8",
-      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
-      "name": "rfc3987",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/rfc3987@1.3.8",
-      "type": "library",
-      "version": "1.3.8"
-    },
-    {
-      "bom-ref": "rpds-py@0.12.0",
-      "description": "Python bindings to Rust's persistent data structures (rpds)",
-      "name": "rpds-py",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/rpds-py@0.12.0",
-      "type": "library",
-      "version": "0.12.0"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "name": "sortedcontainers",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    },
-    {
-      "bom-ref": "uri-template@1.3.0",
-      "description": "RFC 6570 URI Template Processor",
-      "name": "uri-template",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/uri-template@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "webcolors@1.13",
-      "description": "A library for working with the color formats defined by HTML and CSS.",
-      "name": "webcolors",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/webcolors@1.13",
-      "type": "library",
-      "version": "1.13"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "attrs@23.1.0"
-    },
-    {
-      "ref": "boolean.py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "fqdn@1.5.1"
-    },
-    {
-      "ref": "idna@3.4"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "jsonpointer@2.4"
-    },
-    {
-      "ref": "jsonschema-specifications@2023.7.1"
-    },
-    {
-      "ref": "jsonschema@4.19.2"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "lxml@4.9.3"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "referencing@0.30.2"
-    },
-    {
-      "ref": "rfc3339-validator@0.1.4"
-    },
-    {
-      "ref": "rfc3987@1.3.8"
-    },
-    {
-      "ref": "rpds-py@0.12.0"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    },
-    {
-      "ref": "uri-template@1.3.0"
-    },
-    {
-      "ref": "webcolors@1.13"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index 0903ce29..00000000
--- a/tests/_data/snapshots/poetry/more-deps-1.1-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,302 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="boolean.py@4.0">
-      <name>boolean.py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean.py@4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="attrs@23.1.0"/>
-    <dependency ref="boolean.py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="fqdn@1.5.1"/>
-    <dependency ref="idna@3.4"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="jsonpointer@2.4"/>
-    <dependency ref="jsonschema-specifications@2023.7.1"/>
-    <dependency ref="jsonschema@4.19.2"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="lxml@4.9.3"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="referencing@0.30.2"/>
-    <dependency ref="rfc3339-validator@0.1.4"/>
-    <dependency ref="rfc3987@1.3.8"/>
-    <dependency ref="rpds-py@0.12.0"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-    <dependency ref="uri-template@1.3.0"/>
-    <dependency ref="webcolors@1.13"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index e82e2499..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,187 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>boolean-py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean-py@4.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index 46c518dd..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,1169 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="boolean-py@4.0">
-      <name>boolean-py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean-py@4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license-expression-30.1.1.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py-serializable-0.15.0.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri-template-1.3.0.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index 149a46e7..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,1552 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "externalReferences": [
-        {
-          "comment": "file: arrow-1.3.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        },
-        {
-          "comment": "file: arrow-1.3.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        }
-      ],
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "attrs@23.1.0",
-      "description": "Classes Without Boilerplate",
-      "externalReferences": [
-        {
-          "comment": "file: attrs-23.1.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/attrs/23.1.0"
-        },
-        {
-          "comment": "file: attrs-23.1.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/attrs/23.1.0"
-        }
-      ],
-      "name": "attrs",
-      "purl": "pkg:pypi/attrs@23.1.0",
-      "type": "library",
-      "version": "23.1.0"
-    },
-    {
-      "bom-ref": "boolean-py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "externalReferences": [
-        {
-          "comment": "file: boolean.py-4.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/boolean-py/4.0"
-        },
-        {
-          "comment": "file: boolean.py-4.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/boolean-py/4.0"
-        }
-      ],
-      "name": "boolean-py",
-      "purl": "pkg:pypi/boolean-py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "externalReferences": [
-        {
-          "comment": "file: cyclonedx_python_lib-5.1.1-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
-        },
-        {
-          "comment": "file: cyclonedx_python_lib-5.1.1.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
-        }
-      ],
-      "name": "cyclonedx-python-lib",
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "externalReferences": [
-        {
-          "comment": "file: defusedxml-0.7.1-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/defusedxml/0.7.1"
-        },
-        {
-          "comment": "file: defusedxml-0.7.1.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/defusedxml/0.7.1"
-        }
-      ],
-      "name": "defusedxml",
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "fqdn@1.5.1",
-      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
-      "externalReferences": [
-        {
-          "comment": "file: fqdn-1.5.1-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/fqdn/1.5.1"
-        },
-        {
-          "comment": "file: fqdn-1.5.1.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/fqdn/1.5.1"
-        }
-      ],
-      "name": "fqdn",
-      "purl": "pkg:pypi/fqdn@1.5.1",
-      "type": "library",
-      "version": "1.5.1"
-    },
-    {
-      "bom-ref": "idna@3.4",
-      "description": "Internationalized Domain Names in Applications (IDNA)",
-      "externalReferences": [
-        {
-          "comment": "file: idna-3.4-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/idna/3.4"
-        },
-        {
-          "comment": "file: idna-3.4.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/idna/3.4"
-        }
-      ],
-      "name": "idna",
-      "purl": "pkg:pypi/idna@3.4",
-      "type": "library",
-      "version": "3.4"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "externalReferences": [
-        {
-          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        },
-        {
-          "comment": "file: isoduration-20.11.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        }
-      ],
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "jsonpointer@2.4",
-      "description": "Identify specific nodes in a JSON document (RFC 6901)",
-      "externalReferences": [
-        {
-          "comment": "file: jsonpointer-2.4-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonpointer/2.4"
-        },
-        {
-          "comment": "file: jsonpointer-2.4.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonpointer/2.4"
-        }
-      ],
-      "name": "jsonpointer",
-      "purl": "pkg:pypi/jsonpointer@2.4",
-      "type": "library",
-      "version": "2.4"
-    },
-    {
-      "bom-ref": "jsonschema@4.19.2",
-      "description": "An implementation of JSON Schema validation for Python",
-      "externalReferences": [
-        {
-          "comment": "file: jsonschema-4.19.2-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema/4.19.2"
-        },
-        {
-          "comment": "file: jsonschema-4.19.2.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema/4.19.2"
-        }
-      ],
-      "name": "jsonschema",
-      "purl": "pkg:pypi/jsonschema@4.19.2",
-      "type": "library",
-      "version": "4.19.2"
-    },
-    {
-      "bom-ref": "jsonschema-specifications@2023.7.1",
-      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
-      "externalReferences": [
-        {
-          "comment": "file: jsonschema_specifications-2023.7.1-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
-        },
-        {
-          "comment": "file: jsonschema_specifications-2023.7.1.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
-        }
-      ],
-      "name": "jsonschema-specifications",
-      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
-      "type": "library",
-      "version": "2023.7.1"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "externalReferences": [
-        {
-          "comment": "file: license-expression-30.1.1.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/license-expression/30.1.1"
-        },
-        {
-          "comment": "file: license_expression-30.1.1-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/license-expression/30.1.1"
-        }
-      ],
-      "name": "license-expression",
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "lxml@4.9.3",
-      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
-      "externalReferences": [
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        }
-      ],
-      "name": "lxml",
-      "purl": "pkg:pypi/lxml@4.9.3",
-      "type": "library",
-      "version": "4.9.3"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "externalReferences": [
-        {
-          "comment": "file: packageurl-python-0.11.2.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/packageurl-python/0.11.2"
-        },
-        {
-          "comment": "file: packageurl_python-0.11.2-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/packageurl-python/0.11.2"
-        }
-      ],
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "externalReferences": [
-        {
-          "comment": "file: py-serializable-0.15.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/py-serializable/0.15.0"
-        },
-        {
-          "comment": "file: py_serializable-0.15.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/py-serializable/0.15.0"
-        }
-      ],
-      "name": "py-serializable",
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "externalReferences": [
-        {
-          "comment": "file: python-dateutil-2.8.2.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        },
-        {
-          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        }
-      ],
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "referencing@0.30.2",
-      "description": "JSON Referencing + Python",
-      "externalReferences": [
-        {
-          "comment": "file: referencing-0.30.2-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/referencing/0.30.2"
-        },
-        {
-          "comment": "file: referencing-0.30.2.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/referencing/0.30.2"
-        }
-      ],
-      "name": "referencing",
-      "purl": "pkg:pypi/referencing@0.30.2",
-      "type": "library",
-      "version": "0.30.2"
-    },
-    {
-      "bom-ref": "rfc3339-validator@0.1.4",
-      "description": "A pure python RFC3339 validator",
-      "externalReferences": [
-        {
-          "comment": "file: rfc3339_validator-0.1.4-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
-        },
-        {
-          "comment": "file: rfc3339_validator-0.1.4.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
-        }
-      ],
-      "name": "rfc3339-validator",
-      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
-      "type": "library",
-      "version": "0.1.4"
-    },
-    {
-      "bom-ref": "rfc3987@1.3.8",
-      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
-      "externalReferences": [
-        {
-          "comment": "file: rfc3987-1.3.8-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3987/1.3.8"
-        },
-        {
-          "comment": "file: rfc3987-1.3.8.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3987/1.3.8"
-        }
-      ],
-      "name": "rfc3987",
-      "purl": "pkg:pypi/rfc3987@1.3.8",
-      "type": "library",
-      "version": "1.3.8"
-    },
-    {
-      "bom-ref": "rpds-py@0.12.0",
-      "description": "Python bindings to Rust's persistent data structures (rpds)",
-      "externalReferences": [
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-none-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-none-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-none-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-none-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-none-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-none-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-none-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-none-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-none-win32.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-none-win_amd64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        }
-      ],
-      "name": "rpds-py",
-      "purl": "pkg:pypi/rpds-py@0.12.0",
-      "type": "library",
-      "version": "0.12.0"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "externalReferences": [
-        {
-          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        },
-        {
-          "comment": "file: six-1.16.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        }
-      ],
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "externalReferences": [
-        {
-          "comment": "file: sortedcontainers-2.4.0-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
-        },
-        {
-          "comment": "file: sortedcontainers-2.4.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
-        }
-      ],
-      "name": "sortedcontainers",
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "externalReferences": [
-        {
-          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        },
-        {
-          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        }
-      ],
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    },
-    {
-      "bom-ref": "uri-template@1.3.0",
-      "description": "RFC 6570 URI Template Processor",
-      "externalReferences": [
-        {
-          "comment": "file: uri-template-1.3.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/uri-template/1.3.0"
-        },
-        {
-          "comment": "file: uri_template-1.3.0-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/uri-template/1.3.0"
-        }
-      ],
-      "name": "uri-template",
-      "purl": "pkg:pypi/uri-template@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "webcolors@1.13",
-      "description": "A library for working with the color formats defined by HTML and CSS.",
-      "externalReferences": [
-        {
-          "comment": "file: webcolors-1.13-py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/webcolors/1.13"
-        },
-        {
-          "comment": "file: webcolors-1.13.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/webcolors/1.13"
-        }
-      ],
-      "name": "webcolors",
-      "purl": "pkg:pypi/webcolors@1.13",
-      "type": "library",
-      "version": "1.13"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "attrs@23.1.0"
-    },
-    {
-      "ref": "boolean-py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "fqdn@1.5.1"
-    },
-    {
-      "ref": "idna@3.4"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "jsonpointer@2.4"
-    },
-    {
-      "ref": "jsonschema-specifications@2023.7.1"
-    },
-    {
-      "ref": "jsonschema@4.19.2"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "lxml@4.9.3"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "referencing@0.30.2"
-    },
-    {
-      "ref": "rfc3339-validator@0.1.4"
-    },
-    {
-      "ref": "rfc3987@1.3.8"
-    },
-    {
-      "ref": "rpds-py@0.12.0"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    },
-    {
-      "ref": "uri-template@1.3.0"
-    },
-    {
-      "ref": "webcolors@1.13"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index a9c6a271..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,1206 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="boolean-py@4.0">
-      <name>boolean-py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean-py@4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license-expression-30.1.1.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py-serializable-0.15.0.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri-template-1.3.0.tar.gz</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="attrs@23.1.0"/>
-    <dependency ref="boolean-py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="fqdn@1.5.1"/>
-    <dependency ref="idna@3.4"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="jsonpointer@2.4"/>
-    <dependency ref="jsonschema-specifications@2023.7.1"/>
-    <dependency ref="jsonschema@4.19.2"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="lxml@4.9.3"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="referencing@0.30.2"/>
-    <dependency ref="rfc3339-validator@0.1.4"/>
-    <dependency ref="rfc3987@1.3.8"/>
-    <dependency ref="rpds-py@0.12.0"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-    <dependency ref="uri-template@1.3.0"/>
-    <dependency ref="webcolors@1.13"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index ebc713f8..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,2986 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "externalReferences": [
-        {
-          "comment": "file: arrow-1.3.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        },
-        {
-          "comment": "file: arrow-1.3.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        }
-      ],
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "attrs@23.1.0",
-      "description": "Classes Without Boilerplate",
-      "externalReferences": [
-        {
-          "comment": "file: attrs-23.1.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/attrs/23.1.0"
-        },
-        {
-          "comment": "file: attrs-23.1.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/attrs/23.1.0"
-        }
-      ],
-      "name": "attrs",
-      "purl": "pkg:pypi/attrs@23.1.0",
-      "type": "library",
-      "version": "23.1.0"
-    },
-    {
-      "bom-ref": "boolean-py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "externalReferences": [
-        {
-          "comment": "file: boolean.py-4.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/boolean-py/4.0"
-        },
-        {
-          "comment": "file: boolean.py-4.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/boolean-py/4.0"
-        }
-      ],
-      "name": "boolean-py",
-      "purl": "pkg:pypi/boolean-py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "externalReferences": [
-        {
-          "comment": "file: cyclonedx_python_lib-5.1.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
-        },
-        {
-          "comment": "file: cyclonedx_python_lib-5.1.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
-        }
-      ],
-      "name": "cyclonedx-python-lib",
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "externalReferences": [
-        {
-          "comment": "file: defusedxml-0.7.1-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/defusedxml/0.7.1"
-        },
-        {
-          "comment": "file: defusedxml-0.7.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/defusedxml/0.7.1"
-        }
-      ],
-      "name": "defusedxml",
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "fqdn@1.5.1",
-      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
-      "externalReferences": [
-        {
-          "comment": "file: fqdn-1.5.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/fqdn/1.5.1"
-        },
-        {
-          "comment": "file: fqdn-1.5.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/fqdn/1.5.1"
-        }
-      ],
-      "name": "fqdn",
-      "purl": "pkg:pypi/fqdn@1.5.1",
-      "type": "library",
-      "version": "1.5.1"
-    },
-    {
-      "bom-ref": "idna@3.4",
-      "description": "Internationalized Domain Names in Applications (IDNA)",
-      "externalReferences": [
-        {
-          "comment": "file: idna-3.4-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/idna/3.4"
-        },
-        {
-          "comment": "file: idna-3.4.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/idna/3.4"
-        }
-      ],
-      "name": "idna",
-      "purl": "pkg:pypi/idna@3.4",
-      "type": "library",
-      "version": "3.4"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "externalReferences": [
-        {
-          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        },
-        {
-          "comment": "file: isoduration-20.11.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        }
-      ],
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "jsonpointer@2.4",
-      "description": "Identify specific nodes in a JSON document (RFC 6901)",
-      "externalReferences": [
-        {
-          "comment": "file: jsonpointer-2.4-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonpointer/2.4"
-        },
-        {
-          "comment": "file: jsonpointer-2.4.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonpointer/2.4"
-        }
-      ],
-      "name": "jsonpointer",
-      "purl": "pkg:pypi/jsonpointer@2.4",
-      "type": "library",
-      "version": "2.4"
-    },
-    {
-      "bom-ref": "jsonschema@4.19.2",
-      "description": "An implementation of JSON Schema validation for Python",
-      "externalReferences": [
-        {
-          "comment": "file: jsonschema-4.19.2-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema/4.19.2"
-        },
-        {
-          "comment": "file: jsonschema-4.19.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema/4.19.2"
-        }
-      ],
-      "name": "jsonschema",
-      "purl": "pkg:pypi/jsonschema@4.19.2",
-      "type": "library",
-      "version": "4.19.2"
-    },
-    {
-      "bom-ref": "jsonschema-specifications@2023.7.1",
-      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
-      "externalReferences": [
-        {
-          "comment": "file: jsonschema_specifications-2023.7.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
-        },
-        {
-          "comment": "file: jsonschema_specifications-2023.7.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
-        }
-      ],
-      "name": "jsonschema-specifications",
-      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
-      "type": "library",
-      "version": "2023.7.1"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "externalReferences": [
-        {
-          "comment": "file: license-expression-30.1.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/license-expression/30.1.1"
-        },
-        {
-          "comment": "file: license_expression-30.1.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/license-expression/30.1.1"
-        }
-      ],
-      "name": "license-expression",
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "lxml@4.9.3",
-      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
-      "externalReferences": [
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        }
-      ],
-      "name": "lxml",
-      "purl": "pkg:pypi/lxml@4.9.3",
-      "type": "library",
-      "version": "4.9.3"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "externalReferences": [
-        {
-          "comment": "file: packageurl-python-0.11.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/packageurl-python/0.11.2"
-        },
-        {
-          "comment": "file: packageurl_python-0.11.2-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/packageurl-python/0.11.2"
-        }
-      ],
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "externalReferences": [
-        {
-          "comment": "file: py-serializable-0.15.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/py-serializable/0.15.0"
-        },
-        {
-          "comment": "file: py_serializable-0.15.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/py-serializable/0.15.0"
-        }
-      ],
-      "name": "py-serializable",
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "externalReferences": [
-        {
-          "comment": "file: python-dateutil-2.8.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        },
-        {
-          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        }
-      ],
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "referencing@0.30.2",
-      "description": "JSON Referencing + Python",
-      "externalReferences": [
-        {
-          "comment": "file: referencing-0.30.2-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/referencing/0.30.2"
-        },
-        {
-          "comment": "file: referencing-0.30.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/referencing/0.30.2"
-        }
-      ],
-      "name": "referencing",
-      "purl": "pkg:pypi/referencing@0.30.2",
-      "type": "library",
-      "version": "0.30.2"
-    },
-    {
-      "bom-ref": "rfc3339-validator@0.1.4",
-      "description": "A pure python RFC3339 validator",
-      "externalReferences": [
-        {
-          "comment": "file: rfc3339_validator-0.1.4-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
-        },
-        {
-          "comment": "file: rfc3339_validator-0.1.4.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
-        }
-      ],
-      "name": "rfc3339-validator",
-      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
-      "type": "library",
-      "version": "0.1.4"
-    },
-    {
-      "bom-ref": "rfc3987@1.3.8",
-      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
-      "externalReferences": [
-        {
-          "comment": "file: rfc3987-1.3.8-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3987/1.3.8"
-        },
-        {
-          "comment": "file: rfc3987-1.3.8.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3987/1.3.8"
-        }
-      ],
-      "name": "rfc3987",
-      "purl": "pkg:pypi/rfc3987@1.3.8",
-      "type": "library",
-      "version": "1.3.8"
-    },
-    {
-      "bom-ref": "rpds-py@0.12.0",
-      "description": "Python bindings to Rust's persistent data structures (rpds)",
-      "externalReferences": [
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        }
-      ],
-      "name": "rpds-py",
-      "purl": "pkg:pypi/rpds-py@0.12.0",
-      "type": "library",
-      "version": "0.12.0"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "externalReferences": [
-        {
-          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        },
-        {
-          "comment": "file: six-1.16.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        }
-      ],
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "externalReferences": [
-        {
-          "comment": "file: sortedcontainers-2.4.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
-        },
-        {
-          "comment": "file: sortedcontainers-2.4.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
-        }
-      ],
-      "name": "sortedcontainers",
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "externalReferences": [
-        {
-          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        },
-        {
-          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        }
-      ],
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    },
-    {
-      "bom-ref": "uri-template@1.3.0",
-      "description": "RFC 6570 URI Template Processor",
-      "externalReferences": [
-        {
-          "comment": "file: uri-template-1.3.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/uri-template/1.3.0"
-        },
-        {
-          "comment": "file: uri_template-1.3.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/uri-template/1.3.0"
-        }
-      ],
-      "name": "uri-template",
-      "purl": "pkg:pypi/uri-template@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "webcolors@1.13",
-      "description": "A library for working with the color formats defined by HTML and CSS.",
-      "externalReferences": [
-        {
-          "comment": "file: webcolors-1.13-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/webcolors/1.13"
-        },
-        {
-          "comment": "file: webcolors-1.13.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/webcolors/1.13"
-        }
-      ],
-      "name": "webcolors",
-      "purl": "pkg:pypi/webcolors@1.13",
-      "type": "library",
-      "version": "1.13"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "attrs@23.1.0"
-    },
-    {
-      "ref": "boolean-py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "fqdn@1.5.1"
-    },
-    {
-      "ref": "idna@3.4"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "jsonpointer@2.4"
-    },
-    {
-      "ref": "jsonschema-specifications@2023.7.1"
-    },
-    {
-      "ref": "jsonschema@4.19.2"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "lxml@4.9.3"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "referencing@0.30.2"
-    },
-    {
-      "ref": "rfc3339-validator@0.1.4"
-    },
-    {
-      "ref": "rfc3987@1.3.8"
-    },
-    {
-      "ref": "rpds-py@0.12.0"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    },
-    {
-      "ref": "uri-template@1.3.0"
-    },
-    {
-      "ref": "webcolors@1.13"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index 1c347fb7..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,1923 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="boolean-py@4.0">
-      <name>boolean-py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean-py@4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license-expression-30.1.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py-serializable-0.15.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri-template-1.3.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="attrs@23.1.0"/>
-    <dependency ref="boolean-py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="fqdn@1.5.1"/>
-    <dependency ref="idna@3.4"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="jsonpointer@2.4"/>
-    <dependency ref="jsonschema-specifications@2023.7.1"/>
-    <dependency ref="jsonschema@4.19.2"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="lxml@4.9.3"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="referencing@0.30.2"/>
-    <dependency ref="rfc3339-validator@0.1.4"/>
-    <dependency ref="rfc3987@1.3.8"/>
-    <dependency ref="rpds-py@0.12.0"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-    <dependency ref="uri-template@1.3.0"/>
-    <dependency ref="webcolors@1.13"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index 0b189fd0..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,3020 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "arrow@1.3.0",
-      "description": "Better dates & times for Python",
-      "externalReferences": [
-        {
-          "comment": "file: arrow-1.3.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        },
-        {
-          "comment": "file: arrow-1.3.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/arrow/1.3.0"
-        }
-      ],
-      "name": "arrow",
-      "purl": "pkg:pypi/arrow@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "attrs@23.1.0",
-      "description": "Classes Without Boilerplate",
-      "externalReferences": [
-        {
-          "comment": "file: attrs-23.1.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/attrs/23.1.0"
-        },
-        {
-          "comment": "file: attrs-23.1.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/attrs/23.1.0"
-        }
-      ],
-      "name": "attrs",
-      "purl": "pkg:pypi/attrs@23.1.0",
-      "type": "library",
-      "version": "23.1.0"
-    },
-    {
-      "bom-ref": "boolean-py@4.0",
-      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
-      "externalReferences": [
-        {
-          "comment": "file: boolean.py-4.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/boolean-py/4.0"
-        },
-        {
-          "comment": "file: boolean.py-4.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/boolean-py/4.0"
-        }
-      ],
-      "name": "boolean-py",
-      "purl": "pkg:pypi/boolean-py@4.0",
-      "type": "library",
-      "version": "4.0"
-    },
-    {
-      "bom-ref": "cyclonedx-python-lib@5.1.1",
-      "description": "Python library for CycloneDX",
-      "externalReferences": [
-        {
-          "comment": "file: cyclonedx_python_lib-5.1.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
-        },
-        {
-          "comment": "file: cyclonedx_python_lib-5.1.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/cyclonedx-python-lib/5.1.1"
-        }
-      ],
-      "name": "cyclonedx-python-lib",
-      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
-      "type": "library",
-      "version": "5.1.1"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "defusedxml@0.7.1",
-      "description": "XML bomb protection for Python stdlib modules",
-      "externalReferences": [
-        {
-          "comment": "file: defusedxml-0.7.1-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/defusedxml/0.7.1"
-        },
-        {
-          "comment": "file: defusedxml-0.7.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/defusedxml/0.7.1"
-        }
-      ],
-      "name": "defusedxml",
-      "purl": "pkg:pypi/defusedxml@0.7.1",
-      "type": "library",
-      "version": "0.7.1"
-    },
-    {
-      "bom-ref": "fqdn@1.5.1",
-      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
-      "externalReferences": [
-        {
-          "comment": "file: fqdn-1.5.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/fqdn/1.5.1"
-        },
-        {
-          "comment": "file: fqdn-1.5.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/fqdn/1.5.1"
-        }
-      ],
-      "name": "fqdn",
-      "purl": "pkg:pypi/fqdn@1.5.1",
-      "type": "library",
-      "version": "1.5.1"
-    },
-    {
-      "bom-ref": "idna@3.4",
-      "description": "Internationalized Domain Names in Applications (IDNA)",
-      "externalReferences": [
-        {
-          "comment": "file: idna-3.4-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/idna/3.4"
-        },
-        {
-          "comment": "file: idna-3.4.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/idna/3.4"
-        }
-      ],
-      "name": "idna",
-      "purl": "pkg:pypi/idna@3.4",
-      "type": "library",
-      "version": "3.4"
-    },
-    {
-      "bom-ref": "isoduration@20.11.0",
-      "description": "Operations with ISO 8601 durations",
-      "externalReferences": [
-        {
-          "comment": "file: isoduration-20.11.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        },
-        {
-          "comment": "file: isoduration-20.11.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/isoduration/20.11.0"
-        }
-      ],
-      "name": "isoduration",
-      "purl": "pkg:pypi/isoduration@20.11.0",
-      "type": "library",
-      "version": "20.11.0"
-    },
-    {
-      "bom-ref": "jsonpointer@2.4",
-      "description": "Identify specific nodes in a JSON document (RFC 6901)",
-      "externalReferences": [
-        {
-          "comment": "file: jsonpointer-2.4-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonpointer/2.4"
-        },
-        {
-          "comment": "file: jsonpointer-2.4.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonpointer/2.4"
-        }
-      ],
-      "name": "jsonpointer",
-      "purl": "pkg:pypi/jsonpointer@2.4",
-      "type": "library",
-      "version": "2.4"
-    },
-    {
-      "bom-ref": "jsonschema@4.19.2",
-      "description": "An implementation of JSON Schema validation for Python",
-      "externalReferences": [
-        {
-          "comment": "file: jsonschema-4.19.2-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema/4.19.2"
-        },
-        {
-          "comment": "file: jsonschema-4.19.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema/4.19.2"
-        }
-      ],
-      "name": "jsonschema",
-      "purl": "pkg:pypi/jsonschema@4.19.2",
-      "type": "library",
-      "version": "4.19.2"
-    },
-    {
-      "bom-ref": "jsonschema-specifications@2023.7.1",
-      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
-      "externalReferences": [
-        {
-          "comment": "file: jsonschema_specifications-2023.7.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
-        },
-        {
-          "comment": "file: jsonschema_specifications-2023.7.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/jsonschema-specifications/2023.7.1"
-        }
-      ],
-      "name": "jsonschema-specifications",
-      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
-      "type": "library",
-      "version": "2023.7.1"
-    },
-    {
-      "bom-ref": "license-expression@30.1.1",
-      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
-      "externalReferences": [
-        {
-          "comment": "file: license-expression-30.1.1.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/license-expression/30.1.1"
-        },
-        {
-          "comment": "file: license_expression-30.1.1-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/license-expression/30.1.1"
-        }
-      ],
-      "name": "license-expression",
-      "purl": "pkg:pypi/license-expression@30.1.1",
-      "type": "library",
-      "version": "30.1.1"
-    },
-    {
-      "bom-ref": "lxml@4.9.3",
-      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
-      "externalReferences": [
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp310-cp310-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp311-cp311-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp312-cp312-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp35-cp35m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp36-cp36m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp37-cp37m-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp38-cp38-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-cp39-cp39-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        },
-        {
-          "comment": "file: lxml-4.9.3.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/lxml/4.9.3"
-        }
-      ],
-      "name": "lxml",
-      "purl": "pkg:pypi/lxml@4.9.3",
-      "type": "library",
-      "version": "4.9.3"
-    },
-    {
-      "bom-ref": "packageurl-python@0.11.2",
-      "description": "A purl aka. Package URL parser and builder",
-      "externalReferences": [
-        {
-          "comment": "file: packageurl-python-0.11.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/packageurl-python/0.11.2"
-        },
-        {
-          "comment": "file: packageurl_python-0.11.2-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/packageurl-python/0.11.2"
-        }
-      ],
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python@0.11.2",
-      "type": "library",
-      "version": "0.11.2"
-    },
-    {
-      "bom-ref": "py-serializable@0.15.0",
-      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
-      "externalReferences": [
-        {
-          "comment": "file: py-serializable-0.15.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/py-serializable/0.15.0"
-        },
-        {
-          "comment": "file: py_serializable-0.15.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/py-serializable/0.15.0"
-        }
-      ],
-      "name": "py-serializable",
-      "purl": "pkg:pypi/py-serializable@0.15.0",
-      "type": "library",
-      "version": "0.15.0"
-    },
-    {
-      "bom-ref": "python-dateutil@2.8.2",
-      "description": "Extensions to the standard Python datetime module",
-      "externalReferences": [
-        {
-          "comment": "file: python-dateutil-2.8.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        },
-        {
-          "comment": "file: python_dateutil-2.8.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/python-dateutil/2.8.2"
-        }
-      ],
-      "name": "python-dateutil",
-      "purl": "pkg:pypi/python-dateutil@2.8.2",
-      "type": "library",
-      "version": "2.8.2"
-    },
-    {
-      "bom-ref": "referencing@0.30.2",
-      "description": "JSON Referencing + Python",
-      "externalReferences": [
-        {
-          "comment": "file: referencing-0.30.2-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/referencing/0.30.2"
-        },
-        {
-          "comment": "file: referencing-0.30.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/referencing/0.30.2"
-        }
-      ],
-      "name": "referencing",
-      "purl": "pkg:pypi/referencing@0.30.2",
-      "type": "library",
-      "version": "0.30.2"
-    },
-    {
-      "bom-ref": "rfc3339-validator@0.1.4",
-      "description": "A pure python RFC3339 validator",
-      "externalReferences": [
-        {
-          "comment": "file: rfc3339_validator-0.1.4-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
-        },
-        {
-          "comment": "file: rfc3339_validator-0.1.4.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3339-validator/0.1.4"
-        }
-      ],
-      "name": "rfc3339-validator",
-      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
-      "type": "library",
-      "version": "0.1.4"
-    },
-    {
-      "bom-ref": "rfc3987@1.3.8",
-      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
-      "externalReferences": [
-        {
-          "comment": "file: rfc3987-1.3.8-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3987/1.3.8"
-        },
-        {
-          "comment": "file: rfc3987-1.3.8.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rfc3987/1.3.8"
-        }
-      ],
-      "name": "rfc3987",
-      "purl": "pkg:pypi/rfc3987@1.3.8",
-      "type": "library",
-      "version": "1.3.8"
-    },
-    {
-      "bom-ref": "rpds-py@0.12.0",
-      "description": "Python bindings to Rust's persistent data structures (rpds)",
-      "externalReferences": [
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp310-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp311-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp312-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp38-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-none-win32.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-cp39-none-win_amd64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        },
-        {
-          "comment": "file: rpds_py-0.12.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/rpds-py/0.12.0"
-        }
-      ],
-      "name": "rpds-py",
-      "purl": "pkg:pypi/rpds-py@0.12.0",
-      "type": "library",
-      "version": "0.12.0"
-    },
-    {
-      "bom-ref": "six@1.16.0",
-      "description": "Python 2 and 3 compatibility utilities",
-      "externalReferences": [
-        {
-          "comment": "file: six-1.16.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        },
-        {
-          "comment": "file: six-1.16.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/six/1.16.0"
-        }
-      ],
-      "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
-      "type": "library",
-      "version": "1.16.0"
-    },
-    {
-      "bom-ref": "sortedcontainers@2.4.0",
-      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
-      "externalReferences": [
-        {
-          "comment": "file: sortedcontainers-2.4.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
-        },
-        {
-          "comment": "file: sortedcontainers-2.4.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/sortedcontainers/2.4.0"
-        }
-      ],
-      "name": "sortedcontainers",
-      "purl": "pkg:pypi/sortedcontainers@2.4.0",
-      "type": "library",
-      "version": "2.4.0"
-    },
-    {
-      "bom-ref": "types-python-dateutil@2.8.19.14",
-      "description": "Typing stubs for python-dateutil",
-      "externalReferences": [
-        {
-          "comment": "file: types-python-dateutil-2.8.19.14.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        },
-        {
-          "comment": "file: types_python_dateutil-2.8.19.14-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/types-python-dateutil/2.8.19.14"
-        }
-      ],
-      "name": "types-python-dateutil",
-      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
-      "type": "library",
-      "version": "2.8.19.14"
-    },
-    {
-      "bom-ref": "uri-template@1.3.0",
-      "description": "RFC 6570 URI Template Processor",
-      "externalReferences": [
-        {
-          "comment": "file: uri-template-1.3.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/uri-template/1.3.0"
-        },
-        {
-          "comment": "file: uri_template-1.3.0-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/uri-template/1.3.0"
-        }
-      ],
-      "name": "uri-template",
-      "purl": "pkg:pypi/uri-template@1.3.0",
-      "type": "library",
-      "version": "1.3.0"
-    },
-    {
-      "bom-ref": "webcolors@1.13",
-      "description": "A library for working with the color formats defined by HTML and CSS.",
-      "externalReferences": [
-        {
-          "comment": "file: webcolors-1.13-py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/webcolors/1.13"
-        },
-        {
-          "comment": "file: webcolors-1.13.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/webcolors/1.13"
-        }
-      ],
-      "name": "webcolors",
-      "purl": "pkg:pypi/webcolors@1.13",
-      "type": "library",
-      "version": "1.13"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "arrow@1.3.0"
-    },
-    {
-      "ref": "attrs@23.1.0"
-    },
-    {
-      "ref": "boolean-py@4.0"
-    },
-    {
-      "ref": "cyclonedx-python-lib@5.1.1"
-    },
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "defusedxml@0.7.1"
-    },
-    {
-      "ref": "fqdn@1.5.1"
-    },
-    {
-      "ref": "idna@3.4"
-    },
-    {
-      "ref": "isoduration@20.11.0"
-    },
-    {
-      "ref": "jsonpointer@2.4"
-    },
-    {
-      "ref": "jsonschema-specifications@2023.7.1"
-    },
-    {
-      "ref": "jsonschema@4.19.2"
-    },
-    {
-      "ref": "license-expression@30.1.1"
-    },
-    {
-      "ref": "lxml@4.9.3"
-    },
-    {
-      "ref": "packageurl-python@0.11.2"
-    },
-    {
-      "ref": "py-serializable@0.15.0"
-    },
-    {
-      "ref": "python-dateutil@2.8.2"
-    },
-    {
-      "ref": "referencing@0.30.2"
-    },
-    {
-      "ref": "rfc3339-validator@0.1.4"
-    },
-    {
-      "ref": "rfc3987@1.3.8"
-    },
-    {
-      "ref": "rpds-py@0.12.0"
-    },
-    {
-      "ref": "six@1.16.0"
-    },
-    {
-      "ref": "sortedcontainers@2.4.0"
-    },
-    {
-      "ref": "types-python-dateutil@2.8.19.14"
-    },
-    {
-      "ref": "uri-template@1.3.0"
-    },
-    {
-      "ref": "webcolors@1.13"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index d5aeaac4..00000000
--- a/tests/_data/snapshots/poetry/more-deps-2.0-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,1949 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="arrow@1.3.0">
-      <name>arrow</name>
-      <version>1.3.0</version>
-      <description>Better dates &amp; times for Python</description>
-      <purl>pkg:pypi/arrow@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/arrow/1.3.0</url>
-          <comment>file: arrow-1.3.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="attrs@23.1.0">
-      <name>attrs</name>
-      <version>23.1.0</version>
-      <description>Classes Without Boilerplate</description>
-      <purl>pkg:pypi/attrs@23.1.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/attrs/23.1.0</url>
-          <comment>file: attrs-23.1.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="boolean-py@4.0">
-      <name>boolean-py</name>
-      <version>4.0</version>
-      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
-      <purl>pkg:pypi/boolean-py@4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/boolean-py/4.0</url>
-          <comment>file: boolean.py-4.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
-      <name>cyclonedx-python-lib</name>
-      <version>5.1.1</version>
-      <description>Python library for CycloneDX</description>
-      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/cyclonedx-python-lib/5.1.1</url>
-          <comment>file: cyclonedx_python_lib-5.1.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="defusedxml@0.7.1">
-      <name>defusedxml</name>
-      <version>0.7.1</version>
-      <description>XML bomb protection for Python stdlib modules</description>
-      <purl>pkg:pypi/defusedxml@0.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/defusedxml/0.7.1</url>
-          <comment>file: defusedxml-0.7.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="fqdn@1.5.1">
-      <name>fqdn</name>
-      <version>1.5.1</version>
-      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
-      <purl>pkg:pypi/fqdn@1.5.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/fqdn/1.5.1</url>
-          <comment>file: fqdn-1.5.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="idna@3.4">
-      <name>idna</name>
-      <version>3.4</version>
-      <description>Internationalized Domain Names in Applications (IDNA)</description>
-      <purl>pkg:pypi/idna@3.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/idna/3.4</url>
-          <comment>file: idna-3.4.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="isoduration@20.11.0">
-      <name>isoduration</name>
-      <version>20.11.0</version>
-      <description>Operations with ISO 8601 durations</description>
-      <purl>pkg:pypi/isoduration@20.11.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/isoduration/20.11.0</url>
-          <comment>file: isoduration-20.11.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonpointer@2.4">
-      <name>jsonpointer</name>
-      <version>2.4</version>
-      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
-      <purl>pkg:pypi/jsonpointer@2.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonpointer/2.4</url>
-          <comment>file: jsonpointer-2.4.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema@4.19.2">
-      <name>jsonschema</name>
-      <version>4.19.2</version>
-      <description>An implementation of JSON Schema validation for Python</description>
-      <purl>pkg:pypi/jsonschema@4.19.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema/4.19.2</url>
-          <comment>file: jsonschema-4.19.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
-      <name>jsonschema-specifications</name>
-      <version>2023.7.1</version>
-      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
-      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/jsonschema-specifications/2023.7.1</url>
-          <comment>file: jsonschema_specifications-2023.7.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="license-expression@30.1.1">
-      <name>license-expression</name>
-      <version>30.1.1</version>
-      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
-      <purl>pkg:pypi/license-expression@30.1.1</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license-expression-30.1.1.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/license-expression/30.1.1</url>
-          <comment>file: license_expression-30.1.1-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="lxml@4.9.3">
-      <name>lxml</name>
-      <version>4.9.3</version>
-      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
-      <purl>pkg:pypi/lxml@4.9.3</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp310-cp310-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp311-cp311-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp312-cp312-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp35-cp35m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp36-cp36m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp37-cp37m-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp38-cp38-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-cp39-cp39-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/lxml/4.9.3</url>
-          <comment>file: lxml-4.9.3.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="packageurl-python@0.11.2">
-      <name>packageurl-python</name>
-      <version>0.11.2</version>
-      <description>A purl aka. Package URL parser and builder</description>
-      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl-python-0.11.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/packageurl-python/0.11.2</url>
-          <comment>file: packageurl_python-0.11.2-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="py-serializable@0.15.0">
-      <name>py-serializable</name>
-      <version>0.15.0</version>
-      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
-      <purl>pkg:pypi/py-serializable@0.15.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py-serializable-0.15.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/py-serializable/0.15.0</url>
-          <comment>file: py_serializable-0.15.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="python-dateutil@2.8.2">
-      <name>python-dateutil</name>
-      <version>2.8.2</version>
-      <description>Extensions to the standard Python datetime module</description>
-      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python-dateutil-2.8.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/python-dateutil/2.8.2</url>
-          <comment>file: python_dateutil-2.8.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="referencing@0.30.2">
-      <name>referencing</name>
-      <version>0.30.2</version>
-      <description>JSON Referencing + Python</description>
-      <purl>pkg:pypi/referencing@0.30.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/referencing/0.30.2</url>
-          <comment>file: referencing-0.30.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3339-validator@0.1.4">
-      <name>rfc3339-validator</name>
-      <version>0.1.4</version>
-      <description>A pure python RFC3339 validator</description>
-      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3339-validator/0.1.4</url>
-          <comment>file: rfc3339_validator-0.1.4.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rfc3987@1.3.8">
-      <name>rfc3987</name>
-      <version>1.3.8</version>
-      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
-      <purl>pkg:pypi/rfc3987@1.3.8</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rfc3987/1.3.8</url>
-          <comment>file: rfc3987-1.3.8.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="rpds-py@0.12.0">
-      <name>rpds-py</name>
-      <version>0.12.0</version>
-      <description>Python bindings to Rust's persistent data structures (rpds)</description>
-      <purl>pkg:pypi/rpds-py@0.12.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp310-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp311-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp312-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp38-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win32.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-cp39-none-win_amd64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/rpds-py/0.12.0</url>
-          <comment>file: rpds_py-0.12.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="six@1.16.0">
-      <name>six</name>
-      <version>1.16.0</version>
-      <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/six/1.16.0</url>
-          <comment>file: six-1.16.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="sortedcontainers@2.4.0">
-      <name>sortedcontainers</name>
-      <version>2.4.0</version>
-      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
-      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/sortedcontainers/2.4.0</url>
-          <comment>file: sortedcontainers-2.4.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
-      <name>types-python-dateutil</name>
-      <version>2.8.19.14</version>
-      <description>Typing stubs for python-dateutil</description>
-      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types-python-dateutil-2.8.19.14.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/types-python-dateutil/2.8.19.14</url>
-          <comment>file: types_python_dateutil-2.8.19.14-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="uri-template@1.3.0">
-      <name>uri-template</name>
-      <version>1.3.0</version>
-      <description>RFC 6570 URI Template Processor</description>
-      <purl>pkg:pypi/uri-template@1.3.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri-template-1.3.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/uri-template/1.3.0</url>
-          <comment>file: uri_template-1.3.0-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="webcolors@1.13">
-      <name>webcolors</name>
-      <version>1.13</version>
-      <description>A library for working with the color formats defined by HTML and CSS.</description>
-      <purl>pkg:pypi/webcolors@1.13</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13-py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/webcolors/1.13</url>
-          <comment>file: webcolors-1.13.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="arrow@1.3.0"/>
-    <dependency ref="attrs@23.1.0"/>
-    <dependency ref="boolean-py@4.0"/>
-    <dependency ref="cyclonedx-python-lib@5.1.1"/>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="defusedxml@0.7.1"/>
-    <dependency ref="fqdn@1.5.1"/>
-    <dependency ref="idna@3.4"/>
-    <dependency ref="isoduration@20.11.0"/>
-    <dependency ref="jsonpointer@2.4"/>
-    <dependency ref="jsonschema-specifications@2023.7.1"/>
-    <dependency ref="jsonschema@4.19.2"/>
-    <dependency ref="license-expression@30.1.1"/>
-    <dependency ref="lxml@4.9.3"/>
-    <dependency ref="packageurl-python@0.11.2"/>
-    <dependency ref="py-serializable@0.15.0"/>
-    <dependency ref="python-dateutil@2.8.2"/>
-    <dependency ref="referencing@0.30.2"/>
-    <dependency ref="rfc3339-validator@0.1.4"/>
-    <dependency ref="rfc3987@1.3.8"/>
-    <dependency ref="rpds-py@0.12.0"/>
-    <dependency ref="six@1.16.0"/>
-    <dependency ref="sortedcontainers@2.4.0"/>
-    <dependency ref="types-python-dateutil@2.8.19.14"/>
-    <dependency ref="uri-template@1.3.0"/>
-    <dependency ref="webcolors@1.13"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index cd92a4cb..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,19 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index 3df273f0..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index 560fd553..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index f915c24e..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,30 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index 9b5b0e2d..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index ece81661..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,36 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index 88d6b780..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,87 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index 29049f25..00000000
--- a/tests/_data/snapshots/poetry/simple-1.0-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,62 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index cd92a4cb..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,19 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index 3df273f0..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index 560fd553..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index f915c24e..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,30 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index 9b5b0e2d..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index ece81661..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,36 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index 88d6b780..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,87 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index 29049f25..00000000
--- a/tests/_data/snapshots/poetry/simple-1.1-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,62 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin
deleted file mode 100644
index cd92a4cb..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.0.xml-file.bin
+++ /dev/null
@@ -1,19 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin
deleted file mode 100644
index 4530a313..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.1.xml-file.bin
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin
deleted file mode 100644
index 0f0611f4..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.json-file.bin
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "externalReferences": [
-        {
-          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        },
-        {
-          "comment": "file: toml-0.10.2.tar.gz",
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        }
-      ],
-      "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin
deleted file mode 100644
index 71882b77..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.2.xml-file.bin
+++ /dev/null
@@ -1,50 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin
deleted file mode 100644
index 92eb21bc..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.json-file.bin
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "externalReferences": [
-        {
-          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        },
-        {
-          "comment": "file: toml-0.10.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        }
-      ],
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin
deleted file mode 100644
index f15701b4..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.3.xml-file.bin
+++ /dev/null
@@ -1,68 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin
deleted file mode 100644
index c96c08b3..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.json-file.bin
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  "components": [
-    {
-      "bom-ref": "ddt@1.6.0",
-      "description": "Data-Driven/Decorated Tests",
-      "externalReferences": [
-        {
-          "comment": "file: ddt-1.6.0-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        },
-        {
-          "comment": "file: ddt-1.6.0.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/ddt/1.6.0"
-        }
-      ],
-      "name": "ddt",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
-      "purl": "pkg:pypi/ddt@1.6.0",
-      "type": "library",
-      "version": "1.6.0"
-    },
-    {
-      "bom-ref": "toml@0.10.2",
-      "description": "Python Library for Tom's Obvious, Minimal Language",
-      "externalReferences": [
-        {
-          "comment": "file: toml-0.10.2-py2.py3-none-any.whl",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        },
-        {
-          "comment": "file: toml-0.10.2.tar.gz",
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/toml/0.10.2"
-        }
-      ],
-      "name": "toml",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "main"
-        }
-      ],
-      "purl": "pkg:pypi/toml@0.10.2",
-      "type": "library",
-      "version": "0.10.2"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "ddt@1.6.0"
-    },
-    {
-      "ref": "toml@0.10.2"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
-}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin b/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin
deleted file mode 100644
index b2eabd6a..00000000
--- a/tests/_data/snapshots/poetry/simple-2.0-poetry.lock-1.4.xml-file.bin
+++ /dev/null
@@ -1,94 +0,0 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="ddt@1.6.0">
-      <name>ddt</name>
-      <version>1.6.0</version>
-      <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/ddt/1.6.0</url>
-          <comment>file: ddt-1.6.0.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="toml@0.10.2">
-      <name>toml</name>
-      <version>0.10.2</version>
-      <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2-py2.py3-none-any.whl</comment>
-          <hashes>
-            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/project/toml/0.10.2</url>
-          <comment>file: toml-0.10.2.tar.gz</comment>
-          <hashes>
-            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">main</property>
-      </properties>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="ddt@1.6.0"/>
-    <dependency ref="toml@0.10.2"/>
-  </dependencies>
-</bom>

From 99938756a0976b7b0a63a84baa7b2b59cdcd2d9d Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 6 Nov 2023 20:29:55 +0100
Subject: [PATCH 067/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py |  5 +++--
 cyclonedx_py/_internal/utils/pypi.py   | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/pypi.py

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 6ac4a808..3acec594 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -162,11 +162,12 @@ def _make_component(self, req: 'InstallRequirement') -> 'Component':
                             ) if not is_local and name else None,
             external_references=external_references,
         )
-        if len(hashes) > 0 and len(external_references) == 0:
+        if len(hashes) > 0 and len(external_references) == 0 and name:
             try:
                 component.external_references.add(ExternalReference(
                     type=ExternalReferenceType.DISTRIBUTION,
-                    url=XsUri(component.get_pypi_url()),
+                    # url based on https://warehouse.pypa.io/api-reference/legacy.html
+                    url=XsUri(f'https://pypi.org/simple/{name}/'),
                     hashes=hashes
                 ))
             except InvalidUriException as error:
diff --git a/cyclonedx_py/_internal/utils/pypi.py b/cyclonedx_py/_internal/utils/pypi.py
new file mode 100644
index 00000000..20222135
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/pypi.py
@@ -0,0 +1,18 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+

From 0875fa11ce9e7075a7ae77d892f3acf261fd1843 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 7 Nov 2023 00:23:08 +0100
Subject: [PATCH 068/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py        | 81 ++++++++++---------
 .../infiles/requirements/private-packages.txt |  3 +-
 .../requirements/frozen.txt-1.1.xml-file.bin  |  9 ++-
 .../frozen.txt-1.1.xml-stream.bin             |  9 ++-
 .../requirements/frozen.txt-1.2.json-file.bin | 10 ++-
 .../frozen.txt-1.2.json-stream.bin            | 10 ++-
 .../requirements/frozen.txt-1.2.xml-file.bin  |  9 ++-
 .../frozen.txt-1.2.xml-stream.bin             |  9 ++-
 .../requirements/frozen.txt-1.3.json-file.bin | 10 ++-
 .../frozen.txt-1.3.json-stream.bin            | 10 ++-
 .../requirements/frozen.txt-1.3.xml-file.bin  |  9 ++-
 .../frozen.txt-1.3.xml-stream.bin             |  9 ++-
 .../requirements/frozen.txt-1.4.json-file.bin | 10 ++-
 .../frozen.txt-1.4.json-stream.bin            | 10 ++-
 .../requirements/frozen.txt-1.4.xml-file.bin  |  9 ++-
 .../frozen.txt-1.4.xml-stream.bin             |  9 ++-
 .../requirements/local.txt-1.1.xml-file.bin   | 23 ++++--
 .../requirements/local.txt-1.1.xml-stream.bin | 23 ++++--
 .../requirements/local.txt-1.2.json-file.bin  | 25 ++++--
 .../local.txt-1.2.json-stream.bin             | 25 ++++--
 .../requirements/local.txt-1.2.xml-file.bin   | 23 ++++--
 .../requirements/local.txt-1.2.xml-stream.bin | 23 ++++--
 .../requirements/local.txt-1.3.json-file.bin  | 25 ++++--
 .../local.txt-1.3.json-stream.bin             | 25 ++++--
 .../requirements/local.txt-1.3.xml-file.bin   | 23 ++++--
 .../requirements/local.txt-1.3.xml-stream.bin | 23 ++++--
 .../requirements/local.txt-1.4.json-file.bin  | 25 ++++--
 .../local.txt-1.4.json-stream.bin             | 25 ++++--
 .../requirements/local.txt-1.4.xml-file.bin   | 23 ++++--
 .../requirements/local.txt-1.4.xml-stream.bin | 23 ++++--
 .../requirements/nested.txt-1.1.xml-file.bin  |  9 ++-
 .../requirements/nested.txt-1.2.json-file.bin | 10 ++-
 .../requirements/nested.txt-1.2.xml-file.bin  |  9 ++-
 .../requirements/nested.txt-1.3.json-file.bin | 10 ++-
 .../requirements/nested.txt-1.3.xml-file.bin  |  9 ++-
 .../requirements/nested.txt-1.4.json-file.bin | 10 ++-
 .../requirements/nested.txt-1.4.xml-file.bin  |  9 ++-
 .../private-packages.txt-1.0.xml-file.bin     |  2 +-
 .../private-packages.txt-1.0.xml-stream.bin   |  2 +-
 .../private-packages.txt-1.1.xml-file.bin     | 10 ++-
 .../private-packages.txt-1.1.xml-stream.bin   | 10 ++-
 .../private-packages.txt-1.2.json-file.bin    | 13 ++-
 .../private-packages.txt-1.2.json-stream.bin  | 13 ++-
 .../private-packages.txt-1.2.xml-file.bin     | 12 ++-
 .../private-packages.txt-1.2.xml-stream.bin   | 12 ++-
 .../private-packages.txt-1.3.json-file.bin    | 13 ++-
 .../private-packages.txt-1.3.json-stream.bin  | 13 ++-
 .../private-packages.txt-1.3.xml-file.bin     | 12 ++-
 .../private-packages.txt-1.3.xml-stream.bin   | 12 ++-
 .../private-packages.txt-1.4.json-file.bin    | 13 ++-
 .../private-packages.txt-1.4.json-stream.bin  | 13 ++-
 .../private-packages.txt-1.4.xml-file.bin     | 12 ++-
 .../private-packages.txt-1.4.xml-stream.bin   | 12 ++-
 ...issue448.cp1252.txt.bin-1.1.xml-stream.bin | 18 +++++
 ...ssue448.cp1252.txt.bin-1.2.json-stream.bin | 21 +++++
 ...issue448.cp1252.txt.bin-1.2.xml-stream.bin | 18 +++++
 ...ssue448.cp1252.txt.bin-1.3.json-stream.bin | 21 +++++
 ...issue448.cp1252.txt.bin-1.3.xml-stream.bin | 18 +++++
 ...ssue448.cp1252.txt.bin-1.4.json-stream.bin | 21 +++++
 ...issue448.cp1252.txt.bin-1.4.xml-stream.bin | 18 +++++
 .../with-comments.txt-1.1.xml-file.bin        | 30 +++++++
 .../with-comments.txt-1.1.xml-stream.bin      | 30 +++++++
 .../with-comments.txt-1.2.json-file.bin       | 35 ++++++++
 .../with-comments.txt-1.2.json-stream.bin     | 35 ++++++++
 .../with-comments.txt-1.2.xml-file.bin        | 30 +++++++
 .../with-comments.txt-1.2.xml-stream.bin      | 30 +++++++
 .../with-comments.txt-1.3.json-file.bin       | 35 ++++++++
 .../with-comments.txt-1.3.json-stream.bin     | 35 ++++++++
 .../with-comments.txt-1.3.xml-file.bin        | 30 +++++++
 .../with-comments.txt-1.3.xml-stream.bin      | 30 +++++++
 .../with-comments.txt-1.4.json-file.bin       | 35 ++++++++
 .../with-comments.txt-1.4.json-stream.bin     | 35 ++++++++
 .../with-comments.txt-1.4.xml-file.bin        | 30 +++++++
 .../with-comments.txt-1.4.xml-stream.bin      | 30 +++++++
 .../with-hashes.txt-1.1.xml-file.bin          | 10 ++-
 .../with-hashes.txt-1.1.xml-stream.bin        | 10 ++-
 .../with-hashes.txt-1.2.json-file.bin         | 10 ++-
 .../with-hashes.txt-1.2.json-stream.bin       | 10 ++-
 .../with-hashes.txt-1.2.xml-file.bin          | 10 ++-
 .../with-hashes.txt-1.2.xml-stream.bin        | 10 ++-
 .../with-hashes.txt-1.3.json-file.bin         | 10 ++-
 .../with-hashes.txt-1.3.json-stream.bin       | 10 ++-
 .../with-hashes.txt-1.3.xml-file.bin          | 10 ++-
 .../with-hashes.txt-1.3.xml-stream.bin        | 10 ++-
 .../with-hashes.txt-1.4.json-file.bin         | 10 ++-
 .../with-hashes.txt-1.4.json-stream.bin       | 10 ++-
 .../with-hashes.txt-1.4.xml-file.bin          | 10 ++-
 .../with-hashes.txt-1.4.xml-stream.bin        | 10 ++-
 .../with-urls.txt-1.0.xml-file.bin            | 14 ++--
 .../with-urls.txt-1.0.xml-stream.bin          | 14 ++--
 .../with-urls.txt-1.1.xml-file.bin            | 35 ++++----
 .../with-urls.txt-1.1.xml-stream.bin          | 35 ++++----
 .../with-urls.txt-1.2.json-file.bin           | 49 ++++++-----
 .../with-urls.txt-1.2.json-stream.bin         | 49 ++++++-----
 .../with-urls.txt-1.2.xml-file.bin            | 49 ++++++-----
 .../with-urls.txt-1.2.xml-stream.bin          | 49 ++++++-----
 .../with-urls.txt-1.3.json-file.bin           | 49 ++++++-----
 .../with-urls.txt-1.3.json-stream.bin         | 49 ++++++-----
 .../with-urls.txt-1.3.xml-file.bin            | 49 ++++++-----
 .../with-urls.txt-1.3.xml-stream.bin          | 49 ++++++-----
 .../with-urls.txt-1.4.json-file.bin           | 49 ++++++-----
 .../with-urls.txt-1.4.json-stream.bin         | 49 ++++++-----
 .../with-urls.txt-1.4.xml-file.bin            | 49 ++++++-----
 .../with-urls.txt-1.4.xml-stream.bin          | 49 ++++++-----
 ...thout-pinned-versions.txt-1.1.xml-file.bin | 18 +++++
 ...out-pinned-versions.txt-1.1.xml-stream.bin | 18 +++++
 ...hout-pinned-versions.txt-1.2.json-file.bin | 21 +++++
 ...ut-pinned-versions.txt-1.2.json-stream.bin | 21 +++++
 ...thout-pinned-versions.txt-1.2.xml-file.bin | 18 +++++
 ...out-pinned-versions.txt-1.2.xml-stream.bin | 18 +++++
 ...hout-pinned-versions.txt-1.3.json-file.bin | 21 +++++
 ...ut-pinned-versions.txt-1.3.json-stream.bin | 21 +++++
 ...thout-pinned-versions.txt-1.3.xml-file.bin | 18 +++++
 ...out-pinned-versions.txt-1.3.xml-stream.bin | 18 +++++
 ...hout-pinned-versions.txt-1.4.json-file.bin | 21 +++++
 ...ut-pinned-versions.txt-1.4.json-stream.bin | 21 +++++
 ...thout-pinned-versions.txt-1.4.xml-file.bin | 18 +++++
 ...out-pinned-versions.txt-1.4.xml-stream.bin | 18 +++++
 118 files changed, 1962 insertions(+), 509 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 3acec594..a90a2eee 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -56,6 +56,14 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                                      python3 -m pip freeze | %(prog)s -
                            '''),
                            **kwargs)
+        p.add_argument('-i', '--index-url',
+                       metavar='URL',
+                       help='Base URL of the Python Package Index'
+                            ' (default: %(default)s) '
+                            ' This should point to a repository compliant with PEP 503 (the simple repository API)'
+                            ' or a local directory laid out in the same format.',
+                       dest='index_url',
+                       default='https://pypi.org/simple')
         p.add_argument('requirements_file',
                        metavar='requirements-file',
                        help='I HELP TODO (default: %(default)r in current working directory)',
@@ -65,8 +73,10 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
     def __init__(self, *,
                  logger: 'Logger',
+                 index_url: str,
                  **kwargs: Any) -> None:
         self._logger = logger
+        self._index_url = index_url
 
     def __call__(self, *,  # type:ignore[override]
                  requirements_file: str,
@@ -93,8 +103,13 @@ def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
 
         bom = make_bom()
 
+        index_url = self._index_url
+        for opt in rf.options:
+            index_url = opt.options.get('index_url') or index_url
+        self._logger.debug('index_url = %r', index_url)
+
         for requirement in rf.requirements:
-            component = self._make_component(requirement)
+            component = self._make_component(requirement, index_url=index_url)
             self._logger.debug('Add component: %r', component)
             if not component.version:
                 self._logger.warning('Component has no pinned version: %r', component)
@@ -113,7 +128,8 @@ def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None,
                 self._logger.debug('skipping hash %s', hash, exc_info=error)
                 del error
 
-    def _make_component(self, req: 'InstallRequirement') -> 'Component':
+    def _make_component(self, req: 'InstallRequirement',
+                        *, index_url: str = None) -> 'Component':
         from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
         from cyclonedx.model.component import Component, ComponentType
@@ -127,31 +143,33 @@ def _make_component(self, req: 'InstallRequirement') -> 'Component':
 
         # workaround for https://github.com/nexB/pip-requirements-parser/issues/24
         is_local = req.is_local_path and (not req.link or req.link.scheme in ['', 'file'])
-        if is_local:
-            if req.is_wheel or req.is_archive:
-                purl_qualifiers['file_name'] = req.link.url
-                try:
-                    external_references.append(ExternalReference(
-                        comment='local path to wheel/archive',
-                        type=ExternalReferenceType.OTHER,
-                        url=XsUri(req.link.url)))
-                except InvalidUriException as error:
-                    self._logger.debug('skipping location for line: %s', req.line, exc_info=error)
-                    del error
-        elif req.is_url:
-            if '://files.pythonhosted.org/' not in req.link.url:
-                # skip PURL bloat, do not add implicit information
-                purl_qualifiers['vcs_url' if req.is_vcs_url else 'download_url'] = req.link.url
-            try:
+        try:
+            if is_local:
+                external_references.append(ExternalReference(
+                    comment='explicit local path',
+                    type=ExternalReferenceType.OTHER,
+                    url=XsUri(req.link.url),
+                    hashes=hashes))
+            elif req.is_url:
+                if '://files.pythonhosted.org/' not in req.link.url:
+                    # skip PURL bloat, do not add implicit information
+                    purl_qualifiers['vcs_url' if req.is_vcs_url else 'download_url'] = req.link.url
                 external_references.append(ExternalReference(
+                    comment='explicit dist url',
                     type=ExternalReferenceType.VCS if req.is_vcs_url else ExternalReferenceType.DISTRIBUTION,
                     url=XsUri(req.link.url),
-                    hashes=hashes
-                ))
-            except InvalidUriException as error:
-                self._logger.debug('skipping URL for line: %s', req.line, exc_info=error)
-                del error
-        component = Component(
+                    hashes=hashes))
+            else:
+                external_references.append(ExternalReference(
+                    comment='implicit dist url',
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    # url based on https://warehouse.pypa.io/api-reference/legacy.html
+                    url=XsUri(f'{index_url or self._index_url}/{name}/'),
+                    hashes=hashes))
+        except InvalidUriException as error:
+            self._logger.debug('failed ExternalReference/url URL for: %s', req.line, exc_info=error)
+            del error
+        return Component(
             bom_ref=f'requirements-L{req.line_number}',
             description=f'requirements line {req.line_number}: {req.line}',
             type=ComponentType.LIBRARY,
@@ -160,17 +178,4 @@ def _make_component(self, req: 'InstallRequirement') -> 'Component':
             purl=PackageURL(type='pypi', name=req.name, version=version,
                             qualifiers=purl_qualifiers
                             ) if not is_local and name else None,
-            external_references=external_references,
-        )
-        if len(hashes) > 0 and len(external_references) == 0 and name:
-            try:
-                component.external_references.add(ExternalReference(
-                    type=ExternalReferenceType.DISTRIBUTION,
-                    # url based on https://warehouse.pypa.io/api-reference/legacy.html
-                    url=XsUri(f'https://pypi.org/simple/{name}/'),
-                    hashes=hashes
-                ))
-            except InvalidUriException as error:
-                self._logger.debug('skipped hashes for: %s', req.line, exc_info=error)
-                del error
-        return component
+            external_references=external_references)
diff --git a/tests/_data/infiles/requirements/private-packages.txt b/tests/_data/infiles/requirements/private-packages.txt
index fd112891..4199e716 100644
--- a/tests/_data/infiles/requirements/private-packages.txt
+++ b/tests/_data/infiles/requirements/private-packages.txt
@@ -1,6 +1,5 @@
 ## pip option to use an alternative package registry
-## !!!! not implemented, yet -- should reflect this in the PURL and other places.
 
---extra-index-url https://mypi.org/simple/
+--index-url https://mypi.org/simple/
 
 mypackage==1.2.3
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
index 9fbfdcab..884f106e 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
@@ -8,7 +8,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -17,6 +18,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
index 9fbfdcab..884f106e 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
@@ -8,7 +8,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -17,6 +18,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
index a4325f8f..54b59ce1 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
@@ -5,8 +5,9 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -17,6 +18,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
index a4325f8f..54b59ce1 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
@@ -5,8 +5,9 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -17,6 +18,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
index cfd51133..0bb8014a 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -31,6 +32,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
index cfd51133..0bb8014a 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -31,6 +32,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
index 8db77d9f..721c5238 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -27,6 +28,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
index 8db77d9f..721c5238 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -27,6 +28,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
index 3603685b..c5c0f0dd 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -35,6 +36,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
index 3603685b..c5c0f0dd 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -35,6 +36,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
index a9b7be6d..ab9765f0 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -27,6 +28,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
index a9b7be6d..ab9765f0 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -27,6 +28,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
index 95f3b4d6..c0acda5a 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
@@ -74,7 +74,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -87,6 +88,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
index 95f3b4d6..c0acda5a 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
@@ -74,7 +74,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -87,6 +88,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
index 52ff562c..8cb3212f 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
@@ -5,6 +5,12 @@
       <name>foo</name>
       <version/>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -13,7 +19,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -21,14 +27,21 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -39,7 +52,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -50,7 +63,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
index 52ff562c..8cb3212f 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
@@ -5,6 +5,12 @@
       <name>foo</name>
       <version/>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -13,7 +19,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -21,14 +27,21 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -39,7 +52,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -50,7 +63,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
index aec79d97..93744060 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
       "name": "foo",
       "type": "library",
       "version": ""
@@ -12,7 +19,7 @@
       "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
@@ -24,6 +31,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
       "name": "unknown",
       "type": "library",
       "version": ""
@@ -33,8 +47,9 @@
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
-          "type": "distribution",
-          "url": "https://pypi.org/project/unknown"
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/requests"
         }
       ],
       "name": "unknown",
@@ -46,7 +61,7 @@
       "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./myproject/idna.whl"
         }
@@ -60,7 +75,7 @@
       "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.26.1.tar.gz"
         }
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
index aec79d97..93744060 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
       "name": "foo",
       "type": "library",
       "version": ""
@@ -12,7 +19,7 @@
       "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
@@ -24,6 +31,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
       "name": "unknown",
       "type": "library",
       "version": ""
@@ -33,8 +47,9 @@
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
-          "type": "distribution",
-          "url": "https://pypi.org/project/unknown"
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/requests"
         }
       ],
       "name": "unknown",
@@ -46,7 +61,7 @@
       "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./myproject/idna.whl"
         }
@@ -60,7 +75,7 @@
       "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.26.1.tar.gz"
         }
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
index 594477e6..30ea9c4d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
@@ -19,6 +19,12 @@
       <name>foo</name>
       <version/>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -27,7 +33,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -35,14 +41,21 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -53,7 +66,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -64,7 +77,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
index 594477e6..30ea9c4d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
@@ -19,6 +19,12 @@
       <name>foo</name>
       <version/>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -27,7 +33,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -35,14 +41,21 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -53,7 +66,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -64,7 +77,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
index ef71ab04..1eb4b4c8 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
       "name": "foo",
       "type": "library",
       "version": ""
@@ -12,7 +19,7 @@
       "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
@@ -24,6 +31,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
       "name": "unknown",
       "type": "library",
       "version": ""
@@ -33,14 +47,15 @@
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
+          "comment": "explicit local path",
           "hashes": [
             {
               "alg": "SHA-256",
               "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
             }
           ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/unknown"
+          "type": "other",
+          "url": "./myproject/requests"
         }
       ],
       "name": "unknown",
@@ -52,7 +67,7 @@
       "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./myproject/idna.whl"
         }
@@ -66,7 +81,7 @@
       "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.26.1.tar.gz"
         }
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
index ef71ab04..1eb4b4c8 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
       "name": "foo",
       "type": "library",
       "version": ""
@@ -12,7 +19,7 @@
       "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
@@ -24,6 +31,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
       "name": "unknown",
       "type": "library",
       "version": ""
@@ -33,14 +47,15 @@
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
+          "comment": "explicit local path",
           "hashes": [
             {
               "alg": "SHA-256",
               "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
             }
           ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/unknown"
+          "type": "other",
+          "url": "./myproject/requests"
         }
       ],
       "name": "unknown",
@@ -52,7 +67,7 @@
       "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./myproject/idna.whl"
         }
@@ -66,7 +81,7 @@
       "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.26.1.tar.gz"
         }
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
index e410fd3d..fb576405 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
@@ -19,6 +19,12 @@
       <name>foo</name>
       <version/>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -27,7 +33,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -35,14 +41,21 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
           <hashes>
             <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
           </hashes>
@@ -56,7 +69,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -67,7 +80,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
index e410fd3d..fb576405 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
@@ -19,6 +19,12 @@
       <name>foo</name>
       <version/>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -27,7 +33,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -35,14 +41,21 @@
       <name>unknown</name>
       <version/>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <version/>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
           <hashes>
             <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
           </hashes>
@@ -56,7 +69,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -67,7 +80,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
index cece3574..86171b8d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
       "name": "foo",
       "type": "library"
     },
@@ -11,7 +18,7 @@
       "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
@@ -23,6 +30,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
       "name": "unknown",
       "type": "library"
     },
@@ -31,14 +45,15 @@
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
+          "comment": "explicit local path",
           "hashes": [
             {
               "alg": "SHA-256",
               "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
             }
           ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/unknown"
+          "type": "other",
+          "url": "./myproject/requests"
         }
       ],
       "name": "unknown",
@@ -49,7 +64,7 @@
       "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./myproject/idna.whl"
         }
@@ -62,7 +77,7 @@
       "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.26.1.tar.gz"
         }
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
index cece3574..86171b8d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L11",
       "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
       "name": "foo",
       "type": "library"
     },
@@ -11,7 +18,7 @@
       "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
         }
@@ -23,6 +30,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
       "name": "unknown",
       "type": "library"
     },
@@ -31,14 +45,15 @@
       "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
       "externalReferences": [
         {
+          "comment": "explicit local path",
           "hashes": [
             {
               "alg": "SHA-256",
               "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
             }
           ],
-          "type": "distribution",
-          "url": "https://pypi.org/project/unknown"
+          "type": "other",
+          "url": "./myproject/requests"
         }
       ],
       "name": "unknown",
@@ -49,7 +64,7 @@
       "description": "requirements line 8: -e ./myproject/idna.whl",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./myproject/idna.whl"
         }
@@ -62,7 +77,7 @@
       "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
-          "comment": "local path to wheel/archive",
+          "comment": "explicit local path",
           "type": "other",
           "url": "./downloads/numpy-1.26.1.tar.gz"
         }
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
index 468d4eec..041f015c 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
@@ -70,6 +70,12 @@
     <component type="library" bom-ref="requirements-L11">
       <name>foo</name>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -78,20 +84,27 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>unknown</name>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
           <hashes>
             <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
           </hashes>
@@ -104,7 +117,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -114,7 +127,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
index 468d4eec..041f015c 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
@@ -70,6 +70,12 @@
     <component type="library" bom-ref="requirements-L11">
       <name>foo</name>
       <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L14">
       <name>numpy</name>
@@ -78,20 +84,27 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>unknown</name>
       <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>unknown</name>
       <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/project/unknown</url>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
           <hashes>
             <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
           </hashes>
@@ -104,7 +117,7 @@
       <externalReferences>
         <reference type="other">
           <url>./myproject/idna.whl</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
@@ -114,7 +127,7 @@
       <externalReferences>
         <reference type="other">
           <url>./downloads/numpy-1.26.1.tar.gz</url>
-          <comment>local path to wheel/archive</comment>
+          <comment>explicit local path</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
index 9fbfdcab..884f106e 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
@@ -8,7 +8,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -17,6 +18,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
index a4325f8f..54b59ce1 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
@@ -5,8 +5,9 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -17,6 +18,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
index cfd51133..0bb8014a 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -31,6 +32,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
index 8db77d9f..721c5238 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -27,6 +28,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
index 3603685b..c5c0f0dd 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -35,6 +36,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
index a9b7be6d..ab9765f0 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -27,6 +28,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
index 95f3b4d6..c0acda5a 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
@@ -74,7 +74,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -87,6 +88,12 @@
       <version>0.4.6</version>
       <description>requirements line 4: colorama==0.4.6</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
index 1f478bb2..36531650 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
@@ -4,7 +4,7 @@
     <component type="library">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
index 1f478bb2..36531650 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
@@ -4,7 +4,7 @@
     <component type="library">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
index 8876784b..4c27ab87 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
@@ -1,11 +1,17 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
index 8876784b..4c27ab87 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
@@ -1,11 +1,17 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
index 609fd228..43e53453 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
@@ -1,8 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: mypackage==1.2.3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: mypackage==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://mypi.org/simple//mypackage/"
+        }
+      ],
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +18,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
index 609fd228..43e53453 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
@@ -1,8 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: mypackage==1.2.3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: mypackage==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://mypi.org/simple//mypackage/"
+        }
+      ],
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +18,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
index 4bff9102..c7d4efe2 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
@@ -15,14 +15,20 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
index 4bff9102..c7d4efe2 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
@@ -15,14 +15,20 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
index d92b8a7d..027005b2 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
@@ -1,8 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: mypackage==1.2.3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: mypackage==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://mypi.org/simple//mypackage/"
+        }
+      ],
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +18,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
index d92b8a7d..027005b2 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
@@ -1,8 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: mypackage==1.2.3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: mypackage==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://mypi.org/simple//mypackage/"
+        }
+      ],
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +18,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
index 68220a35..c5d0f7c8 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
@@ -15,14 +15,20 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
index 68220a35..c5d0f7c8 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
@@ -15,14 +15,20 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
index 60182803..0731d1bd 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
@@ -1,8 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: mypackage==1.2.3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: mypackage==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://mypi.org/simple//mypackage/"
+        }
+      ],
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +18,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
index 60182803..0731d1bd 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
@@ -1,8 +1,15 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: mypackage==1.2.3",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: mypackage==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://mypi.org/simple//mypackage/"
+        }
+      ],
       "name": "mypackage",
       "purl": "pkg:pypi/mypackage@1.2.3",
       "type": "library",
@@ -11,7 +18,7 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L5"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
index 33ccf416..4b23dae4 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
@@ -67,14 +67,20 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
index 33ccf416..4b23dae4 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
@@ -67,14 +67,20 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L5">
       <name>mypackage</name>
       <version>1.2.3</version>
-      <description>requirements line 6: mypackage==1.2.3</description>
+      <description>requirements line 5: mypackage==1.2.3</description>
       <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://mypi.org/simple//mypackage/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L5"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin
index 4a2e049e..9143afde 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin
@@ -6,18 +6,36 @@
       <version/>
       <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
       <version/>
       <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
       <version/>
       <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
index f9bc3363..5ab249db 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L6",
       "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
       "name": "packageurl-python",
       "purl": "pkg:pypi/packageurl-python",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
       "name": "requirements_parser",
       "purl": "pkg:pypi/requirements-parser",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L8",
       "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
       "name": "setuptools",
       "purl": "pkg:pypi/setuptools",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
index 17b32550..79629f3e 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
@@ -20,18 +20,36 @@
       <version/>
       <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
       <version/>
       <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
       <version/>
       <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
index 3b1ba6e0..33edf346 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L6",
       "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
       "name": "packageurl-python",
       "purl": "pkg:pypi/packageurl-python",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
       "name": "requirements_parser",
       "purl": "pkg:pypi/requirements-parser",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L8",
       "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
       "name": "setuptools",
       "purl": "pkg:pypi/setuptools",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
index d0f8bd62..c0227f2c 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
@@ -20,18 +20,36 @@
       <version/>
       <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
       <version/>
       <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
       <version/>
       <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
index faf43154..da59867a 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L6",
       "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
       "name": "packageurl-python",
       "purl": "pkg:pypi/packageurl-python",
       "type": "library"
@@ -10,6 +17,13 @@
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
       "name": "requirements_parser",
       "purl": "pkg:pypi/requirements-parser",
       "type": "library"
@@ -17,6 +31,13 @@
     {
       "bom-ref": "requirements-L8",
       "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
       "name": "setuptools",
       "purl": "pkg:pypi/setuptools",
       "type": "library"
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
index b1a9b81c..166edddb 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
@@ -71,16 +71,34 @@
       <name>packageurl-python</name>
       <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
       <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L7">
       <name>requirements_parser</name>
       <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
       <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L8">
       <name>setuptools</name>
       <description>requirements line 8: setuptools&gt;=50.3.2</description>
       <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin
index e173155c..a49b1a98 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin
@@ -6,30 +6,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin
index e173155c..a49b1a98 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin
@@ -6,30 +6,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
index d9242efa..a4ebb28b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
@@ -27,6 +48,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
@@ -35,6 +63,13 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
index d9242efa..a4ebb28b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
@@ -27,6 +48,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
@@ -35,6 +63,13 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
index a979ffbd..b1706738 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
@@ -20,30 +20,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
index a979ffbd..b1706738 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
@@ -20,30 +20,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
index d3d21335..6f64580d 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
@@ -27,6 +48,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
@@ -35,6 +63,13 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
index d3d21335..6f64580d 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
@@ -27,6 +48,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
@@ -35,6 +63,13 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
index 85a94338..e16dafc2 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
@@ -20,30 +20,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
index 85a94338..e16dafc2 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
@@ -20,30 +20,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
index 371c0d09..62bd66cc 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
@@ -27,6 +48,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
@@ -35,6 +63,13 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
index 371c0d09..62bd66cc 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi@2021.5.30",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet@4.0.0",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
       "name": "idna",
       "purl": "pkg:pypi/idna@2.10",
       "type": "library",
@@ -27,6 +48,13 @@
     {
       "bom-ref": "requirements-L4",
       "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
       "name": "requests",
       "purl": "pkg:pypi/requests@2.25.1",
       "type": "library",
@@ -35,6 +63,13 @@
     {
       "bom-ref": "requirements-L5",
       "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3@1.26.5",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
index 6914da3d..0ac47c5b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
@@ -72,30 +72,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
index 6914da3d..0ac47c5b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
@@ -72,30 +72,60 @@
       <version>2021.5.30</version>
       <description>requirements line 1: certifi==2021.5.30</description>
       <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version>4.0.0</version>
       <description>requirements line 2: chardet==4.0.0</description>
       <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>idna</name>
       <version>2.10</version>
       <description>requirements line 3: idna==2.10</description>
       <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L4">
       <name>requests</name>
       <version>2.25.1</version>
       <description>requirements line 4: requests==2.25.1</description>
       <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L5">
       <name>urllib3</name>
       <version>1.26.5</version>
       <description>requirements line 5: urllib3==1.26.5</description>
       <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
index 43d8b2cf..f5a35dc4 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
@@ -8,7 +8,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -19,7 +20,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -31,6 +33,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -41,7 +44,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
index 43d8b2cf..f5a35dc4 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
@@ -8,7 +8,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -19,7 +20,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -31,6 +33,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -41,7 +44,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
index e30b2ac9..7e512e46 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
@@ -5,8 +5,9 @@
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -19,8 +20,9 @@
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/certifi/2021.5.30"
+          "url": "https://pypi.org/simple/certifi/"
         }
       ],
       "name": "certifi",
@@ -33,6 +35,7 @@
       "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -47,8 +50,9 @@
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/urllib3/1.26.5"
+          "url": "https://pypi.org/simple/urllib3/"
         }
       ],
       "name": "urllib3",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
index e30b2ac9..7e512e46 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
@@ -5,8 +5,9 @@
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -19,8 +20,9 @@
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/certifi/2021.5.30"
+          "url": "https://pypi.org/simple/certifi/"
         }
       ],
       "name": "certifi",
@@ -33,6 +35,7 @@
       "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -47,8 +50,9 @@
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://pypi.org/project/urllib3/1.26.5"
+          "url": "https://pypi.org/simple/urllib3/"
         }
       ],
       "name": "urllib3",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
index 98d1d7a8..2c51553e 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -33,7 +34,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -45,6 +47,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -55,7 +58,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
index 98d1d7a8..2c51553e 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -33,7 +34,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -45,6 +47,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -55,7 +58,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
index 2b941210..5a434426 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -29,6 +30,7 @@
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -40,7 +42,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/certifi/2021.5.30"
+          "url": "https://pypi.org/simple/certifi/"
         }
       ],
       "name": "certifi",
@@ -53,6 +55,7 @@
       "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -67,6 +70,7 @@
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -78,7 +82,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/urllib3/1.26.5"
+          "url": "https://pypi.org/simple/urllib3/"
         }
       ],
       "name": "urllib3",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
index 2b941210..5a434426 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -29,6 +30,7 @@
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -40,7 +42,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/certifi/2021.5.30"
+          "url": "https://pypi.org/simple/certifi/"
         }
       ],
       "name": "certifi",
@@ -53,6 +55,7 @@
       "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -67,6 +70,7 @@
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -78,7 +82,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/urllib3/1.26.5"
+          "url": "https://pypi.org/simple/urllib3/"
         }
       ],
       "name": "urllib3",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
index b2e4b3d0..7abf55ed 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -37,7 +38,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
             <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
@@ -53,6 +55,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -63,7 +66,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
             <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
index b2e4b3d0..7abf55ed 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
@@ -22,7 +22,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -37,7 +38,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
             <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
@@ -53,6 +55,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -63,7 +66,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
             <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
index b4c965f7..745f68a2 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -29,6 +30,7 @@
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -40,7 +42,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/certifi/2021.5.30"
+          "url": "https://pypi.org/simple/certifi/"
         }
       ],
       "name": "certifi",
@@ -53,6 +55,7 @@
       "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -66,6 +69,7 @@
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -77,7 +81,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/urllib3/1.26.5"
+          "url": "https://pypi.org/simple/urllib3/"
         }
       ],
       "name": "urllib3",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
index b4c965f7..745f68a2 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
@@ -5,6 +5,7 @@
       "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -16,7 +17,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/FooProject/1.2"
+          "url": "https://pypi.org/simple/FooProject/"
         }
       ],
       "name": "FooProject",
@@ -29,6 +30,7 @@
       "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -40,7 +42,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/certifi/2021.5.30"
+          "url": "https://pypi.org/simple/certifi/"
         }
       ],
       "name": "certifi",
@@ -53,6 +55,7 @@
       "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -66,6 +69,7 @@
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
       "externalReferences": [
         {
+          "comment": "implicit dist url",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -77,7 +81,7 @@
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/project/urllib3/1.26.5"
+          "url": "https://pypi.org/simple/urllib3/"
         }
       ],
       "name": "urllib3",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
index 8a4e074d..5cd0df6a 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
@@ -74,7 +74,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -89,7 +90,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
             <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
@@ -104,6 +106,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -114,7 +117,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
             <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
index 8a4e074d..5cd0df6a 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
@@ -74,7 +74,8 @@
       <purl>pkg:pypi/fooproject@1.2</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/FooProject/1.2</url>
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
             <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
@@ -89,7 +90,8 @@
       <purl>pkg:pypi/certifi@2021.5.30</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/certifi/2021.5.30</url>
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
             <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
@@ -104,6 +106,7 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -114,7 +117,8 @@
       <purl>pkg:pypi/urllib3@1.26.5</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/project/urllib3/1.26.5</url>
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
           <hashes>
             <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
             <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin
index 297d7b08..68562923 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin
@@ -4,48 +4,48 @@
     <component type="library">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin
index 297d7b08..68562923 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin
@@ -4,48 +4,48 @@
     <component type="library">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin
index 75846370..6c4e9f53 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin
@@ -1,79 +1,86 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin
index 75846370..6c4e9f53 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin
@@ -1,79 +1,86 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
index abd9595a..6a2396bd 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
@@ -1,10 +1,11 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L10",
-      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
@@ -15,10 +16,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L4",
-      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
@@ -29,10 +31,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
@@ -43,10 +46,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
@@ -57,10 +61,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
         }
@@ -70,10 +75,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L21",
-      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         }
@@ -84,10 +90,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
         }
@@ -100,25 +107,25 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L10"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L14"
+      "ref": "requirements-L15"
     },
     {
-      "ref": "requirements-L17"
+      "ref": "requirements-L19"
     },
     {
-      "ref": "requirements-L21"
+      "ref": "requirements-L23"
     },
     {
-      "ref": "requirements-L4"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "requirements-L8"
+      "ref": "requirements-L9"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
index abd9595a..6a2396bd 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
@@ -1,10 +1,11 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L10",
-      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
@@ -15,10 +16,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L4",
-      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
@@ -29,10 +31,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
@@ -43,10 +46,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
@@ -57,10 +61,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
         }
@@ -70,10 +75,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L21",
-      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         }
@@ -84,10 +90,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
         }
@@ -100,25 +107,25 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L10"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L14"
+      "ref": "requirements-L15"
     },
     {
-      "ref": "requirements-L17"
+      "ref": "requirements-L19"
     },
     {
-      "ref": "requirements-L21"
+      "ref": "requirements-L23"
     },
     {
-      "ref": "requirements-L4"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "requirements-L8"
+      "ref": "requirements-L9"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
index 698925ee..9e67b581 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
@@ -15,90 +15,97 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L10"/>
-    <dependency ref="requirements-L14"/>
-    <dependency ref="requirements-L17"/>
-    <dependency ref="requirements-L21"/>
-    <dependency ref="requirements-L4"/>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L8"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
index 698925ee..9e67b581 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
@@ -15,90 +15,97 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L10"/>
-    <dependency ref="requirements-L14"/>
-    <dependency ref="requirements-L17"/>
-    <dependency ref="requirements-L21"/>
-    <dependency ref="requirements-L4"/>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L8"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
index e628b8c8..ab5d1242 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
@@ -1,10 +1,11 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L10",
-      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
@@ -15,10 +16,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L4",
-      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
@@ -29,10 +31,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
@@ -43,10 +46,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
@@ -57,10 +61,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
         }
@@ -70,10 +75,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L21",
-      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         }
@@ -84,10 +90,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
         }
@@ -100,25 +107,25 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L10"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L14"
+      "ref": "requirements-L15"
     },
     {
-      "ref": "requirements-L17"
+      "ref": "requirements-L19"
     },
     {
-      "ref": "requirements-L21"
+      "ref": "requirements-L23"
     },
     {
-      "ref": "requirements-L4"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "requirements-L8"
+      "ref": "requirements-L9"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
index e628b8c8..ab5d1242 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
@@ -1,10 +1,11 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L10",
-      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
@@ -15,10 +16,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L4",
-      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
@@ -29,10 +31,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
@@ -43,10 +46,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
@@ -57,10 +61,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
         }
@@ -70,10 +75,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L21",
-      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         }
@@ -84,10 +90,11 @@
       "version": ""
     },
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
         }
@@ -100,25 +107,25 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L10"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L14"
+      "ref": "requirements-L15"
     },
     {
-      "ref": "requirements-L17"
+      "ref": "requirements-L19"
     },
     {
-      "ref": "requirements-L21"
+      "ref": "requirements-L23"
     },
     {
-      "ref": "requirements-L4"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "requirements-L8"
+      "ref": "requirements-L9"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
index 993b81bf..ee1b960c 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
@@ -15,90 +15,97 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L10"/>
-    <dependency ref="requirements-L14"/>
-    <dependency ref="requirements-L17"/>
-    <dependency ref="requirements-L21"/>
-    <dependency ref="requirements-L4"/>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L8"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
index 993b81bf..ee1b960c 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
@@ -15,90 +15,97 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
       <version/>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
       <version/>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
       <version/>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
       <version/>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
       <version/>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
       <version/>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L10"/>
-    <dependency ref="requirements-L14"/>
-    <dependency ref="requirements-L17"/>
-    <dependency ref="requirements-L21"/>
-    <dependency ref="requirements-L4"/>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L8"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
index b4a63e94..f93737d1 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
@@ -1,10 +1,11 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L10",
-      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
@@ -14,10 +15,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L4",
-      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
@@ -27,10 +29,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
@@ -40,10 +43,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
@@ -53,10 +57,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
         }
@@ -65,10 +70,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L21",
-      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         }
@@ -78,10 +84,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
         }
@@ -94,25 +101,25 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L10"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L14"
+      "ref": "requirements-L15"
     },
     {
-      "ref": "requirements-L17"
+      "ref": "requirements-L19"
     },
     {
-      "ref": "requirements-L21"
+      "ref": "requirements-L23"
     },
     {
-      "ref": "requirements-L4"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "requirements-L8"
+      "ref": "requirements-L9"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
index b4a63e94..f93737d1 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
@@ -1,10 +1,11 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L10",
-      "description": "requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
         }
@@ -14,10 +15,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L4",
-      "description": "requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
         }
@@ -27,10 +29,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
         }
@@ -40,10 +43,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "vcs",
           "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
         }
@@ -53,10 +57,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L17",
-      "description": "requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
         }
@@ -65,10 +70,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L21",
-      "description": "requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         }
@@ -78,10 +84,11 @@
       "type": "library"
     },
     {
-      "bom-ref": "requirements-L14",
-      "description": "requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
       "externalReferences": [
         {
+          "comment": "explicit dist url",
           "type": "distribution",
           "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
         }
@@ -94,25 +101,25 @@
   ],
   "dependencies": [
     {
-      "ref": "requirements-L10"
+      "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L14"
+      "ref": "requirements-L15"
     },
     {
-      "ref": "requirements-L17"
+      "ref": "requirements-L19"
     },
     {
-      "ref": "requirements-L21"
+      "ref": "requirements-L23"
     },
     {
-      "ref": "requirements-L4"
+      "ref": "requirements-L5"
     },
     {
-      "ref": "requirements-L6"
+      "ref": "requirements-L7"
     },
     {
-      "ref": "requirements-L8"
+      "ref": "requirements-L9"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
index d7dbae3d..49d74201 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
@@ -67,84 +67,91 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L10"/>
-    <dependency ref="requirements-L14"/>
-    <dependency ref="requirements-L17"/>
-    <dependency ref="requirements-L21"/>
-    <dependency ref="requirements-L4"/>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L8"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
index d7dbae3d..49d74201 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
@@ -67,84 +67,91 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L10">
+    <component type="library" bom-ref="requirements-L11">
       <name>package-four</name>
-      <description>requirements line 10: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
       <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L4">
+    <component type="library" bom-ref="requirements-L5">
       <name>package-one</name>
-      <description>requirements line 4: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
       <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L8">
+    <component type="library" bom-ref="requirements-L9">
       <name>package-three</name>
-      <description>requirements line 8: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
       <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L6">
+    <component type="library" bom-ref="requirements-L7">
       <name>package-two</name>
-      <description>requirements line 6: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
       <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L17">
+    <component type="library" bom-ref="requirements-L19">
       <name>unknown</name>
-      <description>requirements line 17: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
       <externalReferences>
         <reference type="distribution">
           <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L21">
+    <component type="library" bom-ref="requirements-L23">
       <name>urllib3</name>
-      <description>requirements line 21: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
       <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L14">
+    <component type="library" bom-ref="requirements-L15">
       <name>wxPython-Phoenix</name>
       <version>3.0.3.dev1820+49a8884</version>
-      <description>requirements line 14: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
       <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L10"/>
-    <dependency ref="requirements-L14"/>
-    <dependency ref="requirements-L17"/>
-    <dependency ref="requirements-L21"/>
-    <dependency ref="requirements-L4"/>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L8"/>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin
index af722b57..0a6ec589 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin
@@ -6,18 +6,36 @@
       <version/>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin
index af722b57..0a6ec589 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin
@@ -6,18 +6,36 @@
       <version/>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
index 1d6ec9a1..51e19752 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
index 1d6ec9a1..51e19752 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
index 0bec9815..2e4ce077 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
@@ -20,18 +20,36 @@
       <version/>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
index 0bec9815..2e4ce077 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
@@ -20,18 +20,36 @@
       <version/>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
index 75435150..1e3fe2ac 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
index 75435150..1e3fe2ac 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library",
@@ -11,6 +18,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library",
@@ -19,6 +33,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
index 442097d1..c944348c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
@@ -20,18 +20,36 @@
       <version/>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
index 442097d1..c944348c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
@@ -20,18 +20,36 @@
       <version/>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <version/>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <version/>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
index afd6152e..c7d2bafd 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library"
@@ -10,6 +17,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library"
@@ -17,6 +31,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library"
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
index afd6152e..c7d2bafd 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
@@ -3,6 +3,13 @@
     {
       "bom-ref": "requirements-L1",
       "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
       "name": "certifi",
       "purl": "pkg:pypi/certifi",
       "type": "library"
@@ -10,6 +17,13 @@
     {
       "bom-ref": "requirements-L2",
       "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
       "name": "chardet",
       "purl": "pkg:pypi/chardet",
       "type": "library"
@@ -17,6 +31,13 @@
     {
       "bom-ref": "requirements-L3",
       "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
       "name": "urllib3",
       "purl": "pkg:pypi/urllib3",
       "type": "library"
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
index 7db3dac2..f0decf6c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
@@ -71,16 +71,34 @@
       <name>certifi</name>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
index 7db3dac2..f0decf6c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
@@ -71,16 +71,34 @@
       <name>certifi</name>
       <description>requirements line 1: certifi&gt;=2021.5.30</description>
       <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L2">
       <name>chardet</name>
       <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
       <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="requirements-L3">
       <name>urllib3</name>
       <description>requirements line 3: urllib3</description>
       <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>

From 63f9cab148c8e05fe399900291b00a5946d20950 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 7 Nov 2023 03:46:36 +0100
Subject: [PATCH 069/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py    |  11 +--
 cyclonedx_py/_internal/poetry.py | 125 +++++++++++++++++++------------
 2 files changed, 83 insertions(+), 53 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 65c4f82a..9493e67c 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -60,22 +60,23 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
 
         op = ArgumentParser(add_help=False)
         op.add_argument('-o', '--outfile',
+                        metavar='FILE',
                         help='Output file path for your SBOM (set to "-" to output to STDOUT) (default: %(default)s)',
-                        dest='outfile',
                         type=FileType('wt', encoding='utf8'),
+                        dest='outfile',
                         default='-')
         op.add_argument('--sv', '--schema-version',
+                        metavar='VERSION',
                         help='The CycloneDX schema version for your SBOM'
                              f' {{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}'
                              ' (default: %(default)s)',
-                        metavar='VERSION',
                         dest='schema_version',
                         choices=SchemaVersion,
                         type=SchemaVersion.from_version,
                         default=SchemaVersion.V1_4.to_version())
         op.add_argument('--of', '--output-format',
-                        help=f'The output format for your SBOM {choices4enum(OutputFormat)} (default: %(default)s)',
                         metavar='FORMAT',
+                        help=f'The output format for your SBOM {choices4enum(OutputFormat)} (default: %(default)s)',
                         dest='output_format',
                         choices=OutputFormat,
                         type=argparse_type4enum(OutputFormat),
@@ -83,15 +84,15 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
         if BooleanOptionalAction:
             op.add_argument('--validate',
                             help='Whether validate the result before outputting (default: %(default)s)',
-                            dest='validate',
                             action=BooleanOptionalAction,
+                            dest='validate',
                             default=True)
         else:
             vg = op.add_mutually_exclusive_group()
             vg.add_argument('--validate',
                             help='Validate the result before outputting (default: %(default)s)',
-                            dest='validate',
                             action='store_true',
+                            dest='validate',
                             default=True)
             vg.add_argument('--no-validate',
                             help='Do not validate the result before outputting',
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index c00fd142..af35af2a 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -46,46 +46,47 @@ class PoetryBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import ArgumentParser, ONE_OR_MORE, OPTIONAL
+        from argparse import ArgumentParser, OPTIONAL
+        from textwrap import dedent
         from cyclonedx.model.component import ComponentType
         from .utils.args import argparse_type4enum
 
-        p = ArgumentParser(description='Build an SBOM based on Poetry project.',
+        p = ArgumentParser(description=dedent('''\
+                           Build an SBOM based on Poetry project.
+
+                           The options mimic the respective ones from Poetry.
+                           '''),
                            **kwargs)
-        # the args shall mimic the ones from poetry
+        # the args shall mimic the ones from poetry, which uses comma-separated lists and multi-use
         p.add_argument('--without',
-                       metavar='GROUP',
-                       dest='groups_without',
-                       help='The dependency groups to ignore (multiple values allowed)',
-                       action='append',
-                       nargs=ONE_OR_MORE,
-                       default=[])
+                         metavar='GROUPS',
+                         help='The dependency groups to ignore (multiple values allowed)',
+                         action='append',
+                         dest='groups_without',
+                         default=[])
         p.add_argument('--with',
-                       metavar='GROUP',
-                       dest='groups_with',
-                       help='The optional dependency groups to include (multiple values allowed)',
-                       action='append',
-                       nargs=ONE_OR_MORE,
-                       default=[])
+                         metavar='GROUPS',
+                         help='The optional dependency groups to include (multiple values allowed)',
+                         action='append',
+                         dest='groups_with',
+                         default=[])
         p.add_argument('--only',
-                       metavar='GROUP',
-                       dest='groups_only',
-                       help='The only dependency groups to include (multiple values allowed)',
-                       action='append',
-                       nargs=ONE_OR_MORE,
-                       default=[])
+                        metavar='GROUPS',
+                        help='The only dependency groups to include (multiple values allowed)',
+                        action='append',
+                        dest='groups_only',
+                        default=[])
         p.add_argument('--no-dev',
-                       dest='groups_only',
-                       help='Alias for --only=main',
-                       action='append_const',
-                       const='main')
+                        help='Explicitly force: --only main',
+                        dest='no_dev',
+                        action='store_true')
         eg = p.add_mutually_exclusive_group()
         eg.add_argument('--extras',
                         metavar='EXTRAS',
                         help='Extra sets of dependencies to include (multiple values allowed)',
-                        nargs=ONE_OR_MORE,
+                        action='append',
                         dest='extras',
-                        default=False)
+                        default=[])
         eg.add_argument('--all-extras',
                         help='Include all extra dependencies (default: %(default)s)',
                         action='store_true',
@@ -117,6 +118,8 @@ def __init__(self, *,
 
     def __call__(self, *,  # type:ignore[override]
                  project_directory: str,
+                 groups_without: List[str], groups_with: List[str], groups_only: List[str],
+                 no_dev: bool,
                  extras: List[str], all_extras: bool,
                  **kwargs: Any) -> 'Bom':
         from os.path import join
@@ -141,9 +144,30 @@ def __call__(self, *,  # type:ignore[override]
         with pyproject, lock:
             project = toml_loads(pyproject.read())
             po_cfg = project['tool']['poetry']
+            po_cfg.setdefault('group', {})
+            po_cfg['group'].setdefault('main', {'dependencies': po_cfg.get('dependencies', {})})
+            po_cfg['group'].setdefault('dev', {'dependencies': po_cfg.get('dev-dependencies', {})})
+
+            # the group-args shall mimic the ones from poetry, which uses comma-separated lists and multi-use
+            # values be like: ['foo', 'bar,bazz'] -> ['foo', 'bar', 'bazz']
+            if no_dev:
+                groups = {'main', }
+            elif len(groups_only) > 0:
+                groups_only = ','.join(groups_only).split(',')
+                groups = set(groups_only)
+            else:
+                groups_with = ','.join(groups_with).split(',')
+                groups_without = ','.join(groups_without).split(',')
+                print(repr(po_cfg.get('group')))
+                groups = (set(groups_with) | set(
+                    gn for gn, gc in po_cfg.get('group', {}).items()
+                    if not gc.get('optional')
+                )) - set(groups_without)
+
             return self._make_bom(
                 project, toml_loads(lock.read()),
-                po_cfg.get('extras', {}).keys() if all_extras else extras,
+                groups,
+                set(po_cfg.get('extras', {}).keys() if all_extras else ','.join(extras).split(',')),
             )
 
     class _LockEntry(NamedTuple):
@@ -153,12 +177,14 @@ class _LockEntry(NamedTuple):
         extras: Dict[str, Set[str]]
 
     def _make_bom(self, project: 'NameDict', locker: 'NameDict',
-                  filter_extras: List[str]
-                  ) -> 'Bom':
+                  use_groups: Set[str], use_extras: Set[str]) -> 'Bom':
         from cyclonedx.model import Property
 
         from .utils.bom import make_bom
 
+        self._logger.debug('use_groups: %r', use_groups)
+        self._logger.debug('use_extras: %r', use_extras)
+
         bom = make_bom()
 
         po_cfg = project['tool']['poetry']
@@ -166,31 +192,31 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
         bom.metadata.component = root_c = self.__component4poetryproj(po_cfg)
         lock_data: Dict[str, self._LockEntry] = {le.name: le for le in self._parse_lock(locker)}
 
-        dep_groups = {None: po_cfg.get('dependencies', {})}
         extra_deps = set(chain.from_iterable(
-            eds for en, eds in po_cfg.get('extras', {}).items() if en in filter_extras))
-        # TODO add more groups / dev-foo
+            eds for en, eds in po_cfg.get('extras', {}).items() if en in use_extras))
 
         _dep_pattern = re.compile(r'^(?P<name>.+?)(?:\[(?P<extras>.*?)\]])?$')
+        _added_components = set()  # required to prevent hickups and flips
 
         def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
             if name == 'python':
                 return None
             le = lock_data.get(name)
             if le is None:
-                self._logger.debug('skip unlocked component: %s', name)
+                self._logger.warning('skip unlocked component: %s', name)
                 return None
-            if le.component in bom.components:
+            if id(le.component) in _added_components:
                 self._logger.debug('skipped existing component: %s', name)
-                return None
+                return le.component
             self._logger.debug('add component: %r', le.component)
             bom.components.add(le.component)
+            _added_components.add(id(le.component))
             depends_on = []
             for dep in chain(
                 le.dependencies,
                 chain.from_iterable(le.extras.get(extra, []) for extra in extras)
             ):
-                self._logger.debug('component %s depends on %s', name, dep)
+                self._logger.debug('component %r depends on %r', name, dep)
                 depm = _dep_pattern.match(dep)
                 depends_on.append(_add_ld(
                     depm.group('name'),
@@ -200,21 +226,24 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
             return le.component
 
         depends_on = []
-        for group_name, group_deps in dep_groups.items():
-            for dep_name, dep_spec in group_deps.items():
+        for group_name in use_groups:
+            self._logger.debug('processing group %r ...', group_name)
+            for dep_name, dep_spec in po_cfg['group'].get(group_name, {}).get('dependencies', {}).items():
+                self._logger.debug('root-component depends on %s', dep_name)
+                if dep_name == 'python':
+                    continue
+                if dep_name not in lock_data:
+                    self._logger.warning('skip unlocked dependency: %s', dep_name)
+                    continue
+                lock_data[dep_name].component.properties.add(Property(
+                    name=_CdxProperty.PackageGroup.value,
+                    value=group_name
+                ))
                 dep_spec = dep_spec if isinstance(dep_spec, dict) else {'version': dep_spec}
                 if dep_spec.get('optional', False) and dep_name not in extra_deps:
                     self._logger.debug('skip optional dependency: %s', dep_name)
                     continue
-                added_c = _add_ld(dep_name, dep_spec.get('extras') or [])
-                if added_c is None:
-                    continue
-                if group_name is not None:
-                    added_c.properties.add(Property(
-                        name=_CdxProperty.PackageGroup.value,
-                        value=group_name
-                    ))
-                depends_on.append(added_c)
+                depends_on.append(_add_ld(dep_name, dep_spec.get('extras') or []))
         bom.register_dependency(root_c, filter(None, depends_on))
 
         return bom

From dcccbaecc82e9ce9cf8022e9d07010527eab9906 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 7 Nov 2023 03:55:40 +0100
Subject: [PATCH 070/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index af35af2a..8d3f618b 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -29,7 +29,7 @@
 
     from cyclonedx.model import HashType
     from cyclonedx.model.bom import Bom
-    from cyclonedx.model.component import Component
+    from cyclonedx.model.component import Component, ComponentType
 
     NameDict = Dict[str, Any]
 
@@ -106,6 +106,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        help='Type of the main component'
                             f' {{choice: {", ".join(t.value for t in _mc_types)}}}'
                             ' (default: %(default)s)',
+                       dest='mc_type',
                        choices=_mc_types,
                        type=argparse_type4enum(ComponentType),
                        default=ComponentType.APPLICATION.value)
@@ -121,6 +122,7 @@ def __call__(self, *,  # type:ignore[override]
                  groups_without: List[str], groups_with: List[str], groups_only: List[str],
                  no_dev: bool,
                  extras: List[str], all_extras: bool,
+                 mc_type: 'ComponentType',
                  **kwargs: Any) -> 'Bom':
         from os.path import join
         import sys
@@ -168,6 +170,7 @@ def __call__(self, *,  # type:ignore[override]
                 project, toml_loads(lock.read()),
                 groups,
                 set(po_cfg.get('extras', {}).keys() if all_extras else ','.join(extras).split(',')),
+                mc_type,
             )
 
     class _LockEntry(NamedTuple):
@@ -177,7 +180,8 @@ class _LockEntry(NamedTuple):
         extras: Dict[str, Set[str]]
 
     def _make_bom(self, project: 'NameDict', locker: 'NameDict',
-                  use_groups: Set[str], use_extras: Set[str]) -> 'Bom':
+                  use_groups: Set[str], use_extras: Set[str],
+                  mc_type: 'ComponentType') -> 'Bom':
         from cyclonedx.model import Property
 
         from .utils.bom import make_bom
@@ -189,7 +193,9 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         po_cfg = project['tool']['poetry']
 
-        bom.metadata.component = root_c = self.__component4poetryproj(po_cfg)
+        bom.metadata.component = root_c = self.__component4poetryproj(po_cfg, mc_type)
+        self._logger.debug('root-component: %r', root_c)
+
         lock_data: Dict[str, self._LockEntry] = {le.name: le for le in self._parse_lock(locker)}
 
         extra_deps = set(chain.from_iterable(
@@ -248,15 +254,15 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
 
         return bom
 
-    def __component4poetryproj(self, po_cfg: 'NameDict') -> 'Component':
+    def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') -> 'Component':
         from cyclonedx.factory.license import LicenseFactory
         from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri, InvalidUriException
-        from cyclonedx.model.component import Component, ComponentType
+        from cyclonedx.model.component import Component
 
         # see spec: https://python-poetry.org/docs/pyproject/
         comp = Component(
             bom_ref=str(po_cfg.get('name', 'root-component')),
-            type=ComponentType.APPLICATION,  # TODO configurable,
+            type=c_type,
             name=str(po_cfg.get('name', 'unnamed')),
             version=str(po_cfg.get('version', '')) or None,
             description=str(po_cfg.get('description', '')) or None,

From d8007eabc263fd7f587d9e7edba1021f3c9770e4 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 7 Nov 2023 03:56:26 +0100
Subject: [PATCH 071/155] self as author

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pyproject.toml b/pyproject.toml
index 7053de9a..a35e8cb1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,6 +5,7 @@ description = "CycloneDX Software Bill of Materials (SBOM) generation utility"
 authors = [
   "Steven Springett <steve.springett@owasp.org>",
   "Paul Horton <phorton@sonatype.com>",
+  "Jan Kowalleck <jan.kowalleck@gmail.com>",
 ]
 maintainers = [
   "Paul Horton <phorton@sonatype.com>",

From e53aed4f7311eb56ab3a7493e4379d3816e76b93 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 8 Nov 2023 11:20:58 +0100
Subject: [PATCH 072/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py        | 31 ++++++++++++++-----
 .../infiles/requirements/private-packages.txt |  6 ++--
 .../private-packages.txt-1.0.xml-file.bin     |  6 ++--
 .../private-packages.txt-1.0.xml-stream.bin   |  6 ++--
 .../private-packages.txt-1.1.xml-file.bin     | 18 ++++++++---
 .../private-packages.txt-1.1.xml-stream.bin   | 18 ++++++++---
 .../private-packages.txt-1.2.json-file.bin    | 22 +++++++++----
 .../private-packages.txt-1.2.json-stream.bin  | 22 +++++++++----
 .../private-packages.txt-1.2.xml-file.bin     | 20 ++++++++----
 .../private-packages.txt-1.2.xml-stream.bin   | 20 ++++++++----
 .../private-packages.txt-1.3.json-file.bin    | 22 +++++++++----
 .../private-packages.txt-1.3.json-stream.bin  | 22 +++++++++----
 .../private-packages.txt-1.3.xml-file.bin     | 20 ++++++++----
 .../private-packages.txt-1.3.xml-stream.bin   | 20 ++++++++----
 .../private-packages.txt-1.4.json-file.bin    | 22 +++++++++----
 .../private-packages.txt-1.4.json-stream.bin  | 22 +++++++++----
 .../private-packages.txt-1.4.xml-file.bin     | 20 ++++++++----
 .../private-packages.txt-1.4.xml-stream.bin   | 20 ++++++++----
 18 files changed, 240 insertions(+), 97 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index a90a2eee..ba24394a 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,8 +16,9 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+from functools import reduce
 from os import unlink
-from typing import TYPE_CHECKING, Any, Generator
+from typing import TYPE_CHECKING, Any, Generator, List, Set
 
 from . import BomBuilder
 
@@ -64,6 +65,13 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                             ' or a local directory laid out in the same format.',
                        dest='index_url',
                        default='https://pypi.org/simple')
+        p.add_argument('--extra-index-url',
+                       metavar='URL',
+                       help='Extra URLs of package indexes to use in addition to --index-url.'
+                            ' Should follow the same rules as --index-url',
+                       action='append',
+                       dest='extra_index_urls',
+                       default=[])
         p.add_argument('requirements_file',
                        metavar='requirements-file',
                        help='I HELP TODO (default: %(default)r in current working directory)',
@@ -74,9 +82,11 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
     def __init__(self, *,
                  logger: 'Logger',
                  index_url: str,
+                 extra_index_urls: List[str],
                  **kwargs: Any) -> None:
         self._logger = logger
         self._index_url = index_url
+        self._extra_index_urls = set(extra_index_urls)
 
     def __call__(self, *,  # type:ignore[override]
                  requirements_file: str,
@@ -103,13 +113,14 @@ def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
 
         bom = make_bom()
 
-        index_url = self._index_url
-        for opt in rf.options:
-            index_url = opt.options.get('index_url') or index_url
+        index_url = reduce(lambda c, i: i.options.get('index_url') or c, rf.options, self._index_url)
+        extra_index_urls = self._extra_index_urls.union(
+            *filter(None, map(lambda i: i.options.get('extra_index_urls'), rf.options)))
         self._logger.debug('index_url = %r', index_url)
+        self._logger.debug('extra_index_urls = %r', extra_index_urls)
 
         for requirement in rf.requirements:
-            component = self._make_component(requirement, index_url=index_url)
+            component = self._make_component(requirement, index_url, extra_index_urls)
             self._logger.debug('Add component: %r', component)
             if not component.version:
                 self._logger.warning('Component has no pinned version: %r', component)
@@ -129,7 +140,7 @@ def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None,
                 del error
 
     def _make_component(self, req: 'InstallRequirement',
-                        *, index_url: str = None) -> 'Component':
+                        index_url: str, extra_index_urls: Set[str]) -> 'Component':
         from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
         from cyclonedx.model.component import Component, ComponentType
@@ -160,12 +171,18 @@ def _make_component(self, req: 'InstallRequirement',
                     url=XsUri(req.link.url),
                     hashes=hashes))
             else:
+                # url based on https://warehouse.pypa.io/api-reference/legacy.html
                 external_references.append(ExternalReference(
                     comment='implicit dist url',
                     type=ExternalReferenceType.DISTRIBUTION,
-                    # url based on https://warehouse.pypa.io/api-reference/legacy.html
                     url=XsUri(f'{index_url or self._index_url}/{name}/'),
                     hashes=hashes))
+                for eiurl in extra_index_urls:
+                    external_references.append(ExternalReference(
+                        comment='implicit dist extra-url',
+                        type=ExternalReferenceType.DISTRIBUTION,
+                        url=XsUri(f'{eiurl}/{name}/'),
+                        hashes=hashes))
         except InvalidUriException as error:
             self._logger.debug('failed ExternalReference/url URL for: %s', req.line, exc_info=error)
             del error
diff --git a/tests/_data/infiles/requirements/private-packages.txt b/tests/_data/infiles/requirements/private-packages.txt
index 4199e716..3b3b4181 100644
--- a/tests/_data/infiles/requirements/private-packages.txt
+++ b/tests/_data/infiles/requirements/private-packages.txt
@@ -1,5 +1,7 @@
 ## pip option to use an alternative package registry
 
---index-url https://mypi.org/simple/
+--index-url https://pypackages.acme.org/simple/
+--extra-index-url https://legacy1.pypackages.acme.org/simple/
+--extra-index-url https://legacy2.pypackages.acme.org/simple/
 
-mypackage==1.2.3
+my-package==1.2.3
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
index 36531650..197a5c57 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
@@ -2,10 +2,10 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
   <components>
     <component type="library">
-      <name>mypackage</name>
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
index 36531650..197a5c57 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
@@ -2,10 +2,10 @@
 <bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
   <components>
     <component type="library">
-      <name>mypackage</name>
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
index 4c27ab87..010a891d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
@@ -1,14 +1,22 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
index 4c27ab87..010a891d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
@@ -1,14 +1,22 @@
 <?xml version="1.0" ?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
index 43e53453..9430918e 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
@@ -1,24 +1,34 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L5",
-      "description": "requirements line 5: mypackage==1.2.3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
       "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
         {
           "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://mypi.org/simple//mypackage/"
+          "url": "https://pypackages.acme.org/simple//my-package/"
         }
       ],
-      "name": "mypackage",
-      "purl": "pkg:pypi/mypackage@1.2.3",
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
       "type": "library",
       "version": "1.2.3"
     }
   ],
   "dependencies": [
     {
-      "ref": "requirements-L5"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
index 43e53453..9430918e 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
@@ -1,24 +1,34 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L5",
-      "description": "requirements line 5: mypackage==1.2.3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
       "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
         {
           "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://mypi.org/simple//mypackage/"
+          "url": "https://pypackages.acme.org/simple//my-package/"
         }
       ],
-      "name": "mypackage",
-      "purl": "pkg:pypi/mypackage@1.2.3",
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
       "type": "library",
       "version": "1.2.3"
     }
   ],
   "dependencies": [
     {
-      "ref": "requirements-L5"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
index c7d4efe2..2cf41d2c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
@@ -15,20 +15,28 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
index c7d4efe2..2cf41d2c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
@@ -15,20 +15,28 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
index 027005b2..acfb396c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
@@ -1,24 +1,34 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L5",
-      "description": "requirements line 5: mypackage==1.2.3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
       "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
         {
           "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://mypi.org/simple//mypackage/"
+          "url": "https://pypackages.acme.org/simple//my-package/"
         }
       ],
-      "name": "mypackage",
-      "purl": "pkg:pypi/mypackage@1.2.3",
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
       "type": "library",
       "version": "1.2.3"
     }
   ],
   "dependencies": [
     {
-      "ref": "requirements-L5"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
index 027005b2..acfb396c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
@@ -1,24 +1,34 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L5",
-      "description": "requirements line 5: mypackage==1.2.3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
       "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
         {
           "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://mypi.org/simple//mypackage/"
+          "url": "https://pypackages.acme.org/simple//my-package/"
         }
       ],
-      "name": "mypackage",
-      "purl": "pkg:pypi/mypackage@1.2.3",
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
       "type": "library",
       "version": "1.2.3"
     }
   ],
   "dependencies": [
     {
-      "ref": "requirements-L5"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
index c5d0f7c8..0fd61ff9 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
@@ -15,20 +15,28 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
index c5d0f7c8..0fd61ff9 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
@@ -15,20 +15,28 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
index 0731d1bd..a7891db8 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
@@ -1,24 +1,34 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L5",
-      "description": "requirements line 5: mypackage==1.2.3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
       "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
         {
           "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://mypi.org/simple//mypackage/"
+          "url": "https://pypackages.acme.org/simple//my-package/"
         }
       ],
-      "name": "mypackage",
-      "purl": "pkg:pypi/mypackage@1.2.3",
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
       "type": "library",
       "version": "1.2.3"
     }
   ],
   "dependencies": [
     {
-      "ref": "requirements-L5"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
index 0731d1bd..a7891db8 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
@@ -1,24 +1,34 @@
 {
   "components": [
     {
-      "bom-ref": "requirements-L5",
-      "description": "requirements line 5: mypackage==1.2.3",
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
       "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
         {
           "comment": "implicit dist url",
           "type": "distribution",
-          "url": "https://mypi.org/simple//mypackage/"
+          "url": "https://pypackages.acme.org/simple//my-package/"
         }
       ],
-      "name": "mypackage",
-      "purl": "pkg:pypi/mypackage@1.2.3",
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
       "type": "library",
       "version": "1.2.3"
     }
   ],
   "dependencies": [
     {
-      "ref": "requirements-L5"
+      "ref": "requirements-L7"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
index 4b23dae4..09e4f8cd 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
@@ -67,20 +67,28 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
index 4b23dae4..09e4f8cd 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
@@ -67,20 +67,28 @@
     </tools>
   </metadata>
   <components>
-    <component type="library" bom-ref="requirements-L5">
-      <name>mypackage</name>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
       <version>1.2.3</version>
-      <description>requirements line 5: mypackage==1.2.3</description>
-      <purl>pkg:pypi/mypackage@1.2.3</purl>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://mypi.org/simple//mypackage/</url>
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
           <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
   </components>
   <dependencies>
-    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
   </dependencies>
 </bom>

From c03f2c78dceaa05e2b1e267c99701f3e17ae76c0 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 8 Nov 2023 11:38:00 +0100
Subject: [PATCH 073/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py       | 2 +-
 cyclonedx_py/_internal/requirements.py | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 8d3f618b..3b7f0087 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -57,7 +57,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                            The options mimic the respective ones from Poetry.
                            '''),
                            **kwargs)
-        # the args shall mimic the ones from poetry, which uses comma-separated lists and multi-use
+        # the args shall mimic the ones from Poetry, which uses comma-separated lists and multi-use
         p.add_argument('--without',
                          metavar='GROUPS',
                          help='The dependency groups to ignore (multiple values allowed)',
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index ba24394a..58e7a760 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -43,7 +43,11 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
-        p = ArgumentParser(description='Build an SBOM from frozen requirements.',
+        p = ArgumentParser(description=dedent('''\
+                           Build an SBOM from frozen requirements.
+
+                           The options mimic the respective ones from Pip.
+                           '''),
                            epilog=dedent('''\
                            Example Usage:
                              • Build an SBOM from a frozen requirements file:
@@ -57,6 +61,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                                      python3 -m pip freeze | %(prog)s -
                            '''),
                            **kwargs)
+        # the args shall mimic the ones from Pip
         p.add_argument('-i', '--index-url',
                        metavar='URL',
                        help='Base URL of the Python Package Index'

From 66df5481dc04621274ee1e0df1125f1cc5b7683c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 8 Nov 2023 11:41:18 +0100
Subject: [PATCH 074/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 58e7a760..8398d30a 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -50,7 +50,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                            '''),
                            epilog=dedent('''\
                            Example Usage:
-                             • Build an SBOM from a frozen requirements file:
+                             • Build an SBOM from a requirements file:
                                    $ %(prog)s requirements-prod.txt
                              • Merge multiple files and build an SBOM from it:
                                    $ cat requirements/*.txt | %(prog)s -

From 3ac705c67d6d3e5df2dc943dab91712785608c62 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 10 Nov 2023 10:43:42 +0100
Subject: [PATCH 075/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 8398d30a..951b3b2e 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -119,8 +119,8 @@ def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
         bom = make_bom()
 
         index_url = reduce(lambda c, i: i.options.get('index_url') or c, rf.options, self._index_url)
-        extra_index_urls = self._extra_index_urls.union(
-            *filter(None, map(lambda i: i.options.get('extra_index_urls'), rf.options)))
+        extra_index_urls = self._extra_index_urls.union(*(
+            i.options['extra_index_urls'] for i in rf.options if 'extra_index_urls' in i.options))
         self._logger.debug('index_url = %r', index_url)
         self._logger.debug('extra_index_urls = %r', extra_index_urls)
 

From 3395a52396a8bdb79b3db701e91b8fb04eaadfe0 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 10 Nov 2023 19:17:32 +0100
Subject: [PATCH 076/155] poetry wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              |   2 +-
 .../private-packges/lock10/pyproject.toml     |  68 +++++
 .../lock11/pyproject-proto.toml               |  68 +++++
 .../poetry/private-packges/lock20/poetry.lock | 282 ++++++++++++++++++
 .../private-packges/lock20/pyproject.toml     |  68 +++++
 .../poetry/private-packges/pypi-proxy.py      |  52 ++++
 .../private-packges/pyproject-proto.toml      |  68 +++++
 7 files changed, 607 insertions(+), 1 deletion(-)
 create mode 100644 tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/private-packges/lock11/pyproject-proto.toml
 create mode 100644 tests/_data/infiles/poetry/private-packges/lock20/poetry.lock
 create mode 100644 tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml
 create mode 100755 tests/_data/infiles/poetry/private-packges/pypi-proxy.py
 create mode 100644 tests/_data/infiles/poetry/private-packges/pyproject-proto.toml

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 3b7f0087..bcca0bf3 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -267,7 +267,7 @@ def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') ->
             version=str(po_cfg.get('version', '')) or None,
             description=str(po_cfg.get('description', '')) or None,
             licenses=[LicenseFactory().make_from_string(po_cfg['license'])] if 'license' in po_cfg else None,
-            author='; '.join(po_cfg['authors']) if 'authors' in po_cfg else None,
+            author=' | '.join(po_cfg['authors']) if 'authors' in po_cfg else None,
         )
         for ers, ert in [
             ('homepage', ExternalReferenceType.WEBSITE),
diff --git a/tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml b/tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml
new file mode 100644
index 00000000..09ecfd7a
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml
@@ -0,0 +1,68 @@
+[tool.poetry]
+name = "private-packges"
+version = "0.1.0"
+description = "packages from aternative package repositories"
+authors = ["Your Name <you@example.com>"]
+
+
+# see https://python-poetry.org/docs/repositories/
+# run the `pypi-proxy.py` to setup a pypi proxy
+
+
+[[xtool.poetry.source]]
+name = "PyPI"
+priority = "primary"
+
+
+[[tool.poetry.source]]
+name = "default-src"
+url = "http://pysrc1.acme.org:8080/simple/"
+priority = "default"
+
+
+[[tool.poetry.source]]
+name = "explicit-src"
+url = "http://pysrc2.acme.org:8080/simple/"
+priority = "explicit"
+
+
+[[tool.poetry.source]]
+name = "supplemental-src"
+url = "http://pysrc3.acme.org:8080/simple/"
+priority = "supplemental"
+
+
+[[tool.poetry.source]]
+name = "secondary-src"
+url = "http://pysrc4.acme.org:8080/simple/"
+priority = "secondary"
+
+
+[[tool.poetry.source]]
+name = "testpypi"
+url = "https://test.pypi.org/simple/"
+priority = "explicit"
+
+
+
+[[tool.poetry.source]]
+name = "jax-src"
+url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
+priority = "primary"
+
+
+
+
+[tool.poetry.dependencies]
+python = ">=3.9,<3.13"
+# toml = "^0.10.2"
+# colorama = "*"
+# isoduration = "^20.11.0"
+jax = {version = "0.4.20", source = "jax-src"}
+toml = {version = "*", source = "explicit-src"}
+colorama = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/private-packges/lock11/pyproject-proto.toml b/tests/_data/infiles/poetry/private-packges/lock11/pyproject-proto.toml
new file mode 100644
index 00000000..57d603b5
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/lock11/pyproject-proto.toml
@@ -0,0 +1,68 @@
+[tool.poetry]
+name = "private-packges"
+version = "0.1.0"
+description = "packages from aternative package repositories"
+authors = ["Your Name <you@example.com>"]
+
+
+# see https://python-poetry.org/docs/repositories/
+# run the `pypi-proxy.py` to setup a pypi proxy
+
+
+[[tool.poetry.source]]
+name = "PyPI"
+priority = "primary"
+
+
+[[tool.poetry.source]]
+name = "default-src"
+url = "http://pysrc1.acme.org:8080/simple/"
+priority = "default"
+
+
+[[tool.poetry.source]]
+name = "explicit-src"
+url = "http://pysrc2.acme.org:8080/simple/"
+priority = "explicit"
+
+
+[[tool.poetry.source]]
+name = "supplemental-src"
+url = "http://pysrc3.acme.org:8080/simple/"
+priority = "supplemental"
+
+
+[[tool.poetry.source]]
+name = "secondary-src"
+url = "http://pysrc4.acme.org:8080/simple/"
+priority = "secondary"
+
+
+[[tool.poetry.source]]
+name = "testpypi"
+url = "https://test.pypi.org/simple/"
+priority = "explicit"
+
+
+
+[[tool.poetry.source]]
+name = "jax-src"
+url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
+priority = "primary"
+
+
+
+
+[tool.poetry.dependencies]
+python = ">=3.9,<3.13"
+# toml = "^0.10.2"
+# colorama = "*"
+# isoduration = "^20.11.0"
+jax = {version = "0.4.20", source = "jax-src"}
+toml = {version = "*", source = "explicit-src"}
+colorama = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/private-packges/lock20/poetry.lock b/tests/_data/infiles/poetry/private-packges/lock20/poetry.lock
new file mode 100644
index 00000000..442f6f01
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/lock20/poetry.lock
@@ -0,0 +1,282 @@
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+files = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "importlib-metadata"
+version = "6.8.0"
+description = "Read metadata from Python packages"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "importlib_metadata-6.8.0-py3-none-any.whl", hash = "sha256:3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"},
+    {file = "importlib_metadata-6.8.0.tar.gz", hash = "sha256:dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"},
+]
+
+[package.dependencies]
+zipp = ">=0.5"
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+perf = ["ipython"]
+testing = ["flufl.flake8", "importlib-resources (>=1.3)", "packaging", "pyfakefs", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-mypy (>=0.9.1)", "pytest-perf (>=0.9.2)", "pytest-ruff"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "jax"
+version = "0.4.20"
+description = "Differentiate, compile, and transform Numpy code."
+optional = false
+python-versions = ">=3.9"
+files = [
+    {file = "jax-0.4.20-py3-none-any.whl", hash = "sha256:3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"},
+    {file = "jax-0.4.20.tar.gz", hash = "sha256:ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"},
+]
+
+[package.dependencies]
+importlib-metadata = {version = ">=4.6", markers = "python_version < \"3.10\""}
+ml-dtypes = ">=0.2.0"
+numpy = [
+    {version = ">=1.26.0", markers = "python_version >= \"3.12\""},
+    {version = ">=1.23.2", markers = "python_version >= \"3.11\" and python_version < \"3.12\""},
+    {version = ">=1.22", markers = "python_version < \"3.11\""},
+]
+opt-einsum = "*"
+scipy = [
+    {version = ">=1.11.1", markers = "python_version >= \"3.12\""},
+    {version = ">=1.9", markers = "python_version < \"3.12\""},
+]
+
+[package.extras]
+australis = ["protobuf (>=3.13,<4)"]
+ci = ["jaxlib (==0.4.19)"]
+cpu = ["jaxlib (==0.4.20)"]
+cuda = ["jaxlib (==0.4.20+cuda11.cudnn86)"]
+cuda11-cudnn86 = ["jaxlib (==0.4.20+cuda11.cudnn86)"]
+cuda11-local = ["jaxlib (==0.4.20+cuda11.cudnn86)"]
+cuda11-pip = ["jaxlib (==0.4.20+cuda11.cudnn86)", "nvidia-cublas-cu11 (>=11.11)", "nvidia-cuda-cupti-cu11 (>=11.8)", "nvidia-cuda-nvcc-cu11 (>=11.8)", "nvidia-cuda-runtime-cu11 (>=11.8)", "nvidia-cudnn-cu11 (>=8.8)", "nvidia-cufft-cu11 (>=10.9)", "nvidia-cusolver-cu11 (>=11.4)", "nvidia-cusparse-cu11 (>=11.7)", "nvidia-nccl-cu11 (>=2.18.3)"]
+cuda12-local = ["jaxlib (==0.4.20+cuda12.cudnn89)"]
+cuda12-pip = ["jaxlib (==0.4.20+cuda12.cudnn89)", "nvidia-cublas-cu12 (>=12.2.5.6)", "nvidia-cuda-cupti-cu12 (>=12.2.142)", "nvidia-cuda-nvcc-cu12 (>=12.2.140)", "nvidia-cuda-runtime-cu12 (>=12.2.140)", "nvidia-cudnn-cu12 (>=8.9)", "nvidia-cufft-cu12 (>=11.0.8.103)", "nvidia-cusolver-cu12 (>=11.5.2)", "nvidia-cusparse-cu12 (>=12.1.2.141)", "nvidia-nccl-cu12 (>=2.18.3)", "nvidia-nvjitlink-cu12 (>=12.2)"]
+minimum-jaxlib = ["jaxlib (==0.4.14)"]
+tpu = ["jaxlib (==0.4.20)", "libtpu-nightly (==0.1.dev20231102)", "requests"]
+
+[package.source]
+type = "legacy"
+url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
+reference = "jax-src"
+
+[[package]]
+name = "ml-dtypes"
+version = "0.3.1"
+description = ""
+optional = false
+python-versions = ">=3.9"
+files = [
+    {file = "ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"},
+    {file = "ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"},
+    {file = "ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"},
+    {file = "ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl", hash = "sha256:da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl", hash = "sha256:cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl", hash = "sha256:3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl", hash = "sha256:a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl", hash = "sha256:979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"},
+    {file = "ml_dtypes-0.3.1.tar.gz", hash = "sha256:60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"},
+]
+
+[package.dependencies]
+numpy = [
+    {version = ">=1.23.3", markers = "python_version > \"3.10\""},
+    {version = ">=1.21.2", markers = "python_version > \"3.9\" and python_version <= \"3.10\""},
+    {version = ">1.20", markers = "python_version <= \"3.9\""},
+]
+
+[package.extras]
+dev = ["absl-py", "pyink", "pylint (>=2.6.0)", "pytest", "pytest-xdist"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "numpy"
+version = "1.26.1"
+description = "Fundamental package for array computing in Python"
+optional = false
+python-versions = "<3.13,>=3.9"
+files = [
+    {file = "numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"},
+    {file = "numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"},
+    {file = "numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"},
+    {file = "numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"},
+    {file = "numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"},
+    {file = "numpy-1.26.1-cp310-cp310-win32.whl", hash = "sha256:d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"},
+    {file = "numpy-1.26.1-cp310-cp310-win_amd64.whl", hash = "sha256:d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"},
+    {file = "numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"},
+    {file = "numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"},
+    {file = "numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"},
+    {file = "numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"},
+    {file = "numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"},
+    {file = "numpy-1.26.1-cp311-cp311-win32.whl", hash = "sha256:b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"},
+    {file = "numpy-1.26.1-cp311-cp311-win_amd64.whl", hash = "sha256:3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"},
+    {file = "numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"},
+    {file = "numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"},
+    {file = "numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"},
+    {file = "numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"},
+    {file = "numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"},
+    {file = "numpy-1.26.1-cp312-cp312-win32.whl", hash = "sha256:af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"},
+    {file = "numpy-1.26.1-cp312-cp312-win_amd64.whl", hash = "sha256:9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"},
+    {file = "numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"},
+    {file = "numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"},
+    {file = "numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"},
+    {file = "numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"},
+    {file = "numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"},
+    {file = "numpy-1.26.1-cp39-cp39-win32.whl", hash = "sha256:d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"},
+    {file = "numpy-1.26.1-cp39-cp39-win_amd64.whl", hash = "sha256:59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"},
+    {file = "numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl", hash = "sha256:06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"},
+    {file = "numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"},
+    {file = "numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"},
+    {file = "numpy-1.26.1.tar.gz", hash = "sha256:c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"},
+]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "opt-einsum"
+version = "3.3.0"
+description = "Optimizing numpys einsum function"
+optional = false
+python-versions = ">=3.5"
+files = [
+    {file = "opt_einsum-3.3.0-py3-none-any.whl", hash = "sha256:2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"},
+    {file = "opt_einsum-3.3.0.tar.gz", hash = "sha256:59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"},
+]
+
+[package.dependencies]
+numpy = ">=1.7"
+
+[package.extras]
+docs = ["numpydoc", "sphinx (==1.2.3)", "sphinx-rtd-theme", "sphinxcontrib-napoleon"]
+tests = ["pytest", "pytest-cov", "pytest-pep8"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "scipy"
+version = "1.11.3"
+description = "Fundamental algorithms for scientific computing in Python"
+optional = false
+python-versions = "<3.13,>=3.9"
+files = [
+    {file = "scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"},
+    {file = "scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl", hash = "sha256:9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"},
+    {file = "scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"},
+    {file = "scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"},
+    {file = "scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"},
+    {file = "scipy-1.11.3-cp310-cp310-win_amd64.whl", hash = "sha256:033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"},
+    {file = "scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"},
+    {file = "scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl", hash = "sha256:5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"},
+    {file = "scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"},
+    {file = "scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"},
+    {file = "scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"},
+    {file = "scipy-1.11.3-cp311-cp311-win_amd64.whl", hash = "sha256:e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"},
+    {file = "scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"},
+    {file = "scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl", hash = "sha256:0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"},
+    {file = "scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"},
+    {file = "scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"},
+    {file = "scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"},
+    {file = "scipy-1.11.3-cp312-cp312-win_amd64.whl", hash = "sha256:90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"},
+    {file = "scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"},
+    {file = "scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl", hash = "sha256:5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"},
+    {file = "scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"},
+    {file = "scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"},
+    {file = "scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"},
+    {file = "scipy-1.11.3-cp39-cp39-win_amd64.whl", hash = "sha256:4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"},
+    {file = "scipy-1.11.3.tar.gz", hash = "sha256:bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"},
+]
+
+[package.dependencies]
+numpy = ">=1.21.6,<1.28.0"
+
+[package.extras]
+dev = ["click", "cython-lint (>=0.12.2)", "doit (>=0.36.0)", "mypy", "pycodestyle", "pydevtool", "rich-click", "ruff", "types-psutil", "typing_extensions"]
+doc = ["jupytext", "matplotlib (>2)", "myst-nb", "numpydoc", "pooch", "pydata-sphinx-theme (==0.9.0)", "sphinx (!=4.1.0)", "sphinx-design (>=0.2.0)"]
+test = ["asv", "gmpy2", "mpmath", "pooch", "pytest", "pytest-cov", "pytest-timeout", "pytest-xdist", "scikit-umfpack", "threadpoolctl"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc2.acme.org:8080/simple"
+reference = "explicit-src"
+
+[[package]]
+name = "zipp"
+version = "3.17.0"
+description = "Backport of pathlib-compatible object wrapper for zip files"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "zipp-3.17.0-py3-none-any.whl", hash = "sha256:0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"},
+    {file = "zipp-3.17.0.tar.gz", hash = "sha256:84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"},
+]
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-ignore-flaky", "pytest-mypy (>=0.9.1)", "pytest-ruff"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[metadata]
+lock-version = "2.0"
+python-versions = ">=3.9,<3.13"
+content-hash = "228a7fd53acf41383b1bee6612d2f4b118658ffd166e41400c30a57cabe81263"
diff --git a/tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml b/tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml
new file mode 100644
index 00000000..57d603b5
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml
@@ -0,0 +1,68 @@
+[tool.poetry]
+name = "private-packges"
+version = "0.1.0"
+description = "packages from aternative package repositories"
+authors = ["Your Name <you@example.com>"]
+
+
+# see https://python-poetry.org/docs/repositories/
+# run the `pypi-proxy.py` to setup a pypi proxy
+
+
+[[tool.poetry.source]]
+name = "PyPI"
+priority = "primary"
+
+
+[[tool.poetry.source]]
+name = "default-src"
+url = "http://pysrc1.acme.org:8080/simple/"
+priority = "default"
+
+
+[[tool.poetry.source]]
+name = "explicit-src"
+url = "http://pysrc2.acme.org:8080/simple/"
+priority = "explicit"
+
+
+[[tool.poetry.source]]
+name = "supplemental-src"
+url = "http://pysrc3.acme.org:8080/simple/"
+priority = "supplemental"
+
+
+[[tool.poetry.source]]
+name = "secondary-src"
+url = "http://pysrc4.acme.org:8080/simple/"
+priority = "secondary"
+
+
+[[tool.poetry.source]]
+name = "testpypi"
+url = "https://test.pypi.org/simple/"
+priority = "explicit"
+
+
+
+[[tool.poetry.source]]
+name = "jax-src"
+url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
+priority = "primary"
+
+
+
+
+[tool.poetry.dependencies]
+python = ">=3.9,<3.13"
+# toml = "^0.10.2"
+# colorama = "*"
+# isoduration = "^20.11.0"
+jax = {version = "0.4.20", source = "jax-src"}
+toml = {version = "*", source = "explicit-src"}
+colorama = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
new file mode 100755
index 00000000..3788b301
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+"""
+This is a small http proxy to PiPI.
+This might be needed to play this setup.
+"""
+
+import sys
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from os import unlink
+from urllib.request import urlretrieve
+
+
+class PypiProxyReqHandler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        print('> ', self.path, file=sys.stderr)
+        p, m = urlretrieve(f'https://pypi.org{self.path}')
+        print('< ', p, file=sys.stderr)
+        self.send_response(200)
+        for k, v in m.items():
+            self.send_header(k, v)
+        self.end_headers()
+        with open(p, 'rb') as f:
+            self.wfile.write(f.read())
+        unlink(p)
+
+
+if __name__ == '__main__':
+    server_address = ('', int(sys.argv[1]) if len(sys.argv) >= 2 else 8080)
+    httpd = ThreadingHTTPServer(server_address, PypiProxyReqHandler)
+    print(f'running PyPI proxy at: {server_address!r}', file=sys.stderr)
+    try:
+        httpd.serve_forever()
+    except KeyboardInterrupt:
+        httpd.server_close()
diff --git a/tests/_data/infiles/poetry/private-packges/pyproject-proto.toml b/tests/_data/infiles/poetry/private-packges/pyproject-proto.toml
new file mode 100644
index 00000000..57d603b5
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/pyproject-proto.toml
@@ -0,0 +1,68 @@
+[tool.poetry]
+name = "private-packges"
+version = "0.1.0"
+description = "packages from aternative package repositories"
+authors = ["Your Name <you@example.com>"]
+
+
+# see https://python-poetry.org/docs/repositories/
+# run the `pypi-proxy.py` to setup a pypi proxy
+
+
+[[tool.poetry.source]]
+name = "PyPI"
+priority = "primary"
+
+
+[[tool.poetry.source]]
+name = "default-src"
+url = "http://pysrc1.acme.org:8080/simple/"
+priority = "default"
+
+
+[[tool.poetry.source]]
+name = "explicit-src"
+url = "http://pysrc2.acme.org:8080/simple/"
+priority = "explicit"
+
+
+[[tool.poetry.source]]
+name = "supplemental-src"
+url = "http://pysrc3.acme.org:8080/simple/"
+priority = "supplemental"
+
+
+[[tool.poetry.source]]
+name = "secondary-src"
+url = "http://pysrc4.acme.org:8080/simple/"
+priority = "secondary"
+
+
+[[tool.poetry.source]]
+name = "testpypi"
+url = "https://test.pypi.org/simple/"
+priority = "explicit"
+
+
+
+[[tool.poetry.source]]
+name = "jax-src"
+url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
+priority = "primary"
+
+
+
+
+[tool.poetry.dependencies]
+python = ">=3.9,<3.13"
+# toml = "^0.10.2"
+# colorama = "*"
+# isoduration = "^20.11.0"
+jax = {version = "0.4.20", source = "jax-src"}
+toml = {version = "*", source = "explicit-src"}
+colorama = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"

From 9a42664d5b68e4cb55f1b25b22653f871dfd7766 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 11 Nov 2023 11:49:31 +0100
Subject: [PATCH 077/155] poetry wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../poetry/private-packges/lock10/poetry.lock |  40 +++
 .../private-packges/lock10/pyproject.toml     |  51 +--
 .../poetry/private-packges/lock11/poetry.lock | 291 ++++++++++++++++++
 .../{pyproject-proto.toml => pyproject.toml}  |  47 +--
 .../poetry/private-packges/lock20/poetry.lock |   2 +-
 .../private-packges/lock20/pyproject.toml     |  11 +-
 6 files changed, 364 insertions(+), 78 deletions(-)
 create mode 100644 tests/_data/infiles/poetry/private-packges/lock10/poetry.lock
 create mode 100644 tests/_data/infiles/poetry/private-packges/lock11/poetry.lock
 rename tests/_data/infiles/poetry/private-packges/lock11/{pyproject-proto.toml => pyproject.toml} (61%)

diff --git a/tests/_data/infiles/poetry/private-packges/lock10/poetry.lock b/tests/_data/infiles/poetry/private-packges/lock10/poetry.lock
new file mode 100644
index 00000000..e863ce46
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/lock10/poetry.lock
@@ -0,0 +1,40 @@
+[[package]]
+category = "main"
+description = "Cross-platform colored terminal text."
+name = "colorama"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+version = "0.4.6"
+
+[package.source]
+reference = "default-src"
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+
+[[package]]
+category = "main"
+description = "Python Library for Tom's Obvious, Minimal Language"
+name = "toml"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+version = "0.10.2"
+
+[package.source]
+reference = "explicit-src"
+type = "legacy"
+url = "http://pysrc2.acme.org:8080/simple"
+
+[metadata]
+content-hash = "afe83fd12c41d1b471fc48c0c9fbd8c62e793910c4da1ac852437f5adb8e2622"
+lock-version = "1.0"
+python-versions = ">=3.9,<3.13"
+
+[metadata.files]
+colorama = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+toml = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
diff --git a/tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml b/tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml
index 09ecfd7a..290dabb8 100644
--- a/tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml
+++ b/tests/_data/infiles/poetry/private-packges/lock10/pyproject.toml
@@ -5,62 +5,41 @@ description = "packages from aternative package repositories"
 authors = ["Your Name <you@example.com>"]
 
 
-# see https://python-poetry.org/docs/repositories/
+# see https://github.com/python-poetry/poetry/blob/1.1/docs/repositories.md
 # run the `pypi-proxy.py` to setup a pypi proxy
 
-
-[[xtool.poetry.source]]
+[[tool.poetry.source]]
 name = "PyPI"
-priority = "primary"
-
+url = "https://pypi.org/simple/"
+default = false
+secondary = false
 
 [[tool.poetry.source]]
 name = "default-src"
 url = "http://pysrc1.acme.org:8080/simple/"
-priority = "default"
-
-
-[[tool.poetry.source]]
-name = "explicit-src"
-url = "http://pysrc2.acme.org:8080/simple/"
-priority = "explicit"
-
-
-[[tool.poetry.source]]
-name = "supplemental-src"
-url = "http://pysrc3.acme.org:8080/simple/"
-priority = "supplemental"
+default = true
+secondary = false
 
 
 [[tool.poetry.source]]
 name = "secondary-src"
 url = "http://pysrc4.acme.org:8080/simple/"
-priority = "secondary"
+default = false
+secondary = true
 
 
 [[tool.poetry.source]]
-name = "testpypi"
-url = "https://test.pypi.org/simple/"
-priority = "explicit"
-
-
-
-[[tool.poetry.source]]
-name = "jax-src"
-url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
-priority = "primary"
-
+name = "explicit-src"
+url = "http://pysrc2.acme.org:8080/simple/"
+default = false
+secondary = true
 
 
 
 [tool.poetry.dependencies]
 python = ">=3.9,<3.13"
-# toml = "^0.10.2"
-# colorama = "*"
-# isoduration = "^20.11.0"
-jax = {version = "0.4.20", source = "jax-src"}
-toml = {version = "*", source = "explicit-src"}
-colorama = "*"
+toml = {version = "^0.10.2", source = "explicit-src"}
+colorama = "^0.4.6"
 
 
 [build-system]
diff --git a/tests/_data/infiles/poetry/private-packges/lock11/poetry.lock b/tests/_data/infiles/poetry/private-packges/lock11/poetry.lock
new file mode 100644
index 00000000..d6f50d3b
--- /dev/null
+++ b/tests/_data/infiles/poetry/private-packges/lock11/poetry.lock
@@ -0,0 +1,291 @@
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+category = "main"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "importlib-metadata"
+version = "6.8.0"
+description = "Read metadata from Python packages"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[package.dependencies]
+zipp = ">=0.5"
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
+perf = ["ipython"]
+testing = ["flufl.flake8", "importlib-resources (>=1.3)", "packaging", "pyfakefs", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-mypy (>=0.9.1)", "pytest-perf (>=0.9.2)", "pytest-ruff"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "jax"
+version = "0.4.20"
+description = "Differentiate, compile, and transform Numpy code."
+category = "main"
+optional = false
+python-versions = ">=3.9"
+
+[package.dependencies]
+importlib-metadata = {version = ">=4.6", markers = "python_version < \"3.10\""}
+ml-dtypes = ">=0.2.0"
+numpy = [
+    {version = ">=1.22", markers = "python_version < \"3.11\""},
+    {version = ">=1.23.2", markers = "python_version >= \"3.11\""},
+    {version = ">=1.26.0", markers = "python_version >= \"3.12\""},
+]
+opt-einsum = "*"
+scipy = [
+    {version = ">=1.9", markers = "python_version < \"3.12\""},
+    {version = ">=1.11.1", markers = "python_version >= \"3.12\""},
+]
+
+[package.extras]
+australis = ["protobuf (>=3.13,<4)"]
+ci = ["jaxlib (==0.4.19)"]
+cpu = ["jaxlib (==0.4.20)"]
+cuda = ["jaxlib (==0.4.20+cuda11.cudnn86)"]
+cuda11-cudnn86 = ["jaxlib (==0.4.20+cuda11.cudnn86)"]
+cuda11-local = ["jaxlib (==0.4.20+cuda11.cudnn86)"]
+cuda11-pip = ["jaxlib (==0.4.20+cuda11.cudnn86)", "nvidia-cublas-cu11 (>=11.11)", "nvidia-cuda-cupti-cu11 (>=11.8)", "nvidia-cuda-nvcc-cu11 (>=11.8)", "nvidia-cuda-runtime-cu11 (>=11.8)", "nvidia-cudnn-cu11 (>=8.8)", "nvidia-cufft-cu11 (>=10.9)", "nvidia-cusolver-cu11 (>=11.4)", "nvidia-cusparse-cu11 (>=11.7)", "nvidia-nccl-cu11 (>=2.18.3)"]
+cuda12-local = ["jaxlib (==0.4.20+cuda12.cudnn89)"]
+cuda12-pip = ["jaxlib (==0.4.20+cuda12.cudnn89)", "nvidia-cublas-cu12 (>=12.2.5.6)", "nvidia-cuda-cupti-cu12 (>=12.2.142)", "nvidia-cuda-nvcc-cu12 (>=12.2.140)", "nvidia-cuda-runtime-cu12 (>=12.2.140)", "nvidia-cudnn-cu12 (>=8.9)", "nvidia-cufft-cu12 (>=11.0.8.103)", "nvidia-cusolver-cu12 (>=11.5.2)", "nvidia-cusparse-cu12 (>=12.1.2.141)", "nvidia-nccl-cu12 (>=2.18.3)", "nvidia-nvjitlink-cu12 (>=12.2)"]
+minimum-jaxlib = ["jaxlib (==0.4.14)"]
+tpu = ["jaxlib (==0.4.20)", "libtpu-nightly (==0.1.dev20231102)", "requests"]
+
+[package.source]
+type = "legacy"
+url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
+reference = "jax-src"
+
+[[package]]
+name = "ml-dtypes"
+version = "0.3.1"
+description = ""
+category = "main"
+optional = false
+python-versions = ">=3.9"
+
+[package.dependencies]
+numpy = [
+    {version = ">1.20", markers = "python_version <= \"3.9\""},
+    {version = ">=1.23.3", markers = "python_version > \"3.10\""},
+    {version = ">=1.21.2", markers = "python_version > \"3.9\""},
+]
+
+[package.extras]
+dev = ["absl-py", "pyink", "pylint (>=2.6.0)", "pytest", "pytest-xdist"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "numpy"
+version = "1.26.1"
+description = "Fundamental package for array computing in Python"
+category = "main"
+optional = false
+python-versions = ">=3.9"
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "opt-einsum"
+version = "3.3.0"
+description = "Optimizing numpys einsum function"
+category = "main"
+optional = false
+python-versions = ">=3.5"
+
+[package.dependencies]
+numpy = ">=1.7"
+
+[package.extras]
+docs = ["numpydoc", "sphinx (==1.2.3)", "sphinx-rtd-theme", "sphinxcontrib-napoleon"]
+tests = ["pytest", "pytest-cov", "pytest-pep8"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "scipy"
+version = "1.11.3"
+description = "Fundamental algorithms for scientific computing in Python"
+category = "main"
+optional = false
+python-versions = "<3.13,>=3.9"
+
+[package.dependencies]
+numpy = ">=1.21.6,<1.28.0"
+
+[package.extras]
+dev = ["click", "cython-lint (>=0.12.2)", "doit (>=0.36.0)", "mypy", "pycodestyle", "pydevtool", "rich-click", "ruff", "types-psutil", "typing_extensions"]
+doc = ["jupytext", "matplotlib (>2)", "myst-nb", "numpydoc", "pooch", "pydata-sphinx-theme (==0.9.0)", "sphinx (!=4.1.0)", "sphinx-design (>=0.2.0)"]
+test = ["asv", "gmpy2", "mpmath", "pooch", "pytest", "pytest-cov", "pytest-timeout", "pytest-xdist", "scikit-umfpack", "threadpoolctl"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+category = "main"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[package.source]
+type = "legacy"
+url = "http://pysrc2.acme.org:8080/simple"
+reference = "explicit-src"
+
+[[package]]
+name = "zipp"
+version = "3.17.0"
+description = "Backport of pathlib-compatible object wrapper for zip files"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-ignore-flaky", "pytest-mypy (>=0.9.1)", "pytest-ruff"]
+
+[package.source]
+type = "legacy"
+url = "http://pysrc1.acme.org:8080/simple"
+reference = "default-src"
+
+[metadata]
+lock-version = "1.1"
+python-versions = ">=3.9,<3.13"
+content-hash = "6569debdbca76163ca69bb37458a56a013aef2da2bb1682692c1103c7c032b25"
+
+[metadata.files]
+colorama = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+importlib-metadata = [
+    {file = "importlib_metadata-6.8.0-py3-none-any.whl", hash = "sha256:3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"},
+    {file = "importlib_metadata-6.8.0.tar.gz", hash = "sha256:dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"},
+]
+jax = [
+    {file = "jax-0.4.20-py3-none-any.whl", hash = "sha256:3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"},
+    {file = "jax-0.4.20.tar.gz", hash = "sha256:ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"},
+]
+ml-dtypes = [
+    {file = "ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"},
+    {file = "ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"},
+    {file = "ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"},
+    {file = "ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl", hash = "sha256:da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"},
+    {file = "ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl", hash = "sha256:cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl", hash = "sha256:3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"},
+    {file = "ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl", hash = "sha256:a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"},
+    {file = "ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl", hash = "sha256:979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"},
+    {file = "ml_dtypes-0.3.1.tar.gz", hash = "sha256:60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"},
+]
+numpy = [
+    {file = "numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"},
+    {file = "numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"},
+    {file = "numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"},
+    {file = "numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"},
+    {file = "numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"},
+    {file = "numpy-1.26.1-cp310-cp310-win32.whl", hash = "sha256:d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"},
+    {file = "numpy-1.26.1-cp310-cp310-win_amd64.whl", hash = "sha256:d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"},
+    {file = "numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"},
+    {file = "numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"},
+    {file = "numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"},
+    {file = "numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"},
+    {file = "numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"},
+    {file = "numpy-1.26.1-cp311-cp311-win32.whl", hash = "sha256:b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"},
+    {file = "numpy-1.26.1-cp311-cp311-win_amd64.whl", hash = "sha256:3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"},
+    {file = "numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"},
+    {file = "numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"},
+    {file = "numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"},
+    {file = "numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"},
+    {file = "numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"},
+    {file = "numpy-1.26.1-cp312-cp312-win32.whl", hash = "sha256:af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"},
+    {file = "numpy-1.26.1-cp312-cp312-win_amd64.whl", hash = "sha256:9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"},
+    {file = "numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"},
+    {file = "numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"},
+    {file = "numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"},
+    {file = "numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"},
+    {file = "numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"},
+    {file = "numpy-1.26.1-cp39-cp39-win32.whl", hash = "sha256:d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"},
+    {file = "numpy-1.26.1-cp39-cp39-win_amd64.whl", hash = "sha256:59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"},
+    {file = "numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl", hash = "sha256:06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"},
+    {file = "numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"},
+    {file = "numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"},
+    {file = "numpy-1.26.1.tar.gz", hash = "sha256:c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"},
+]
+opt-einsum = [
+    {file = "opt_einsum-3.3.0-py3-none-any.whl", hash = "sha256:2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"},
+    {file = "opt_einsum-3.3.0.tar.gz", hash = "sha256:59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"},
+]
+scipy = [
+    {file = "scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"},
+    {file = "scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl", hash = "sha256:9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"},
+    {file = "scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"},
+    {file = "scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"},
+    {file = "scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"},
+    {file = "scipy-1.11.3-cp310-cp310-win_amd64.whl", hash = "sha256:033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"},
+    {file = "scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"},
+    {file = "scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl", hash = "sha256:5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"},
+    {file = "scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"},
+    {file = "scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"},
+    {file = "scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"},
+    {file = "scipy-1.11.3-cp311-cp311-win_amd64.whl", hash = "sha256:e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"},
+    {file = "scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"},
+    {file = "scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl", hash = "sha256:0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"},
+    {file = "scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"},
+    {file = "scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"},
+    {file = "scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"},
+    {file = "scipy-1.11.3-cp312-cp312-win_amd64.whl", hash = "sha256:90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"},
+    {file = "scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"},
+    {file = "scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl", hash = "sha256:5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"},
+    {file = "scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"},
+    {file = "scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"},
+    {file = "scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"},
+    {file = "scipy-1.11.3-cp39-cp39-win_amd64.whl", hash = "sha256:4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"},
+    {file = "scipy-1.11.3.tar.gz", hash = "sha256:bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"},
+]
+toml = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+zipp = [
+    {file = "zipp-3.17.0-py3-none-any.whl", hash = "sha256:0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"},
+    {file = "zipp-3.17.0.tar.gz", hash = "sha256:84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"},
+]
diff --git a/tests/_data/infiles/poetry/private-packges/lock11/pyproject-proto.toml b/tests/_data/infiles/poetry/private-packges/lock11/pyproject.toml
similarity index 61%
rename from tests/_data/infiles/poetry/private-packges/lock11/pyproject-proto.toml
rename to tests/_data/infiles/poetry/private-packges/lock11/pyproject.toml
index 57d603b5..a7006fdd 100644
--- a/tests/_data/infiles/poetry/private-packges/lock11/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/private-packges/lock11/pyproject.toml
@@ -5,62 +5,47 @@ description = "packages from aternative package repositories"
 authors = ["Your Name <you@example.com>"]
 
 
-# see https://python-poetry.org/docs/repositories/
+# see https://github.com/python-poetry/poetry/blob/1.2/docs/repositories.md
 # run the `pypi-proxy.py` to setup a pypi proxy
 
-
 [[tool.poetry.source]]
 name = "PyPI"
-priority = "primary"
-
+url = "https://pypi.org/simple/"
+default = false
+secondary = false
 
 [[tool.poetry.source]]
 name = "default-src"
 url = "http://pysrc1.acme.org:8080/simple/"
-priority = "default"
-
-
-[[tool.poetry.source]]
-name = "explicit-src"
-url = "http://pysrc2.acme.org:8080/simple/"
-priority = "explicit"
-
-
-[[tool.poetry.source]]
-name = "supplemental-src"
-url = "http://pysrc3.acme.org:8080/simple/"
-priority = "supplemental"
+default = true
+secondary = false
 
 
 [[tool.poetry.source]]
 name = "secondary-src"
 url = "http://pysrc4.acme.org:8080/simple/"
-priority = "secondary"
+default = false
+secondary = true
 
 
 [[tool.poetry.source]]
-name = "testpypi"
-url = "https://test.pypi.org/simple/"
-priority = "explicit"
-
-
+name = "explicit-src"
+url = "http://pysrc2.acme.org:8080/simple/"
+default = false
+secondary = true
 
 [[tool.poetry.source]]
 name = "jax-src"
 url = "https://storage.googleapis.com/jax-releases/jax_releases.html"
-priority = "primary"
-
-
+default = false
+secondary = false
 
 
 [tool.poetry.dependencies]
 python = ">=3.9,<3.13"
-# toml = "^0.10.2"
-# colorama = "*"
-# isoduration = "^20.11.0"
 jax = {version = "0.4.20", source = "jax-src"}
-toml = {version = "*", source = "explicit-src"}
-colorama = "*"
+toml = {version = "^0.10.2", source = "explicit-src"}
+colorama = "^0.4.6"
 
 
 [build-system]
diff --git a/tests/_data/infiles/poetry/private-packges/lock20/poetry.lock b/tests/_data/infiles/poetry/private-packges/lock20/poetry.lock
index 442f6f01..db559fef 100644
--- a/tests/_data/infiles/poetry/private-packges/lock20/poetry.lock
+++ b/tests/_data/infiles/poetry/private-packges/lock20/poetry.lock
@@ -279,4 +279,4 @@ reference = "default-src"
 [metadata]
 lock-version = "2.0"
 python-versions = ">=3.9,<3.13"
-content-hash = "228a7fd53acf41383b1bee6612d2f4b118658ffd166e41400c30a57cabe81263"
+content-hash = "87eb1466760484f7ffadfcf73d1454c99635627aa82e8fd8b9ec68444462aecf"
diff --git a/tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml b/tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml
index 57d603b5..9c0b2cac 100644
--- a/tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml
+++ b/tests/_data/infiles/poetry/private-packges/lock20/pyproject.toml
@@ -32,12 +32,6 @@ url = "http://pysrc3.acme.org:8080/simple/"
 priority = "supplemental"
 
 
-[[tool.poetry.source]]
-name = "secondary-src"
-url = "http://pysrc4.acme.org:8080/simple/"
-priority = "secondary"
-
-
 [[tool.poetry.source]]
 name = "testpypi"
 url = "https://test.pypi.org/simple/"
@@ -55,11 +49,8 @@ priority = "primary"
 
 [tool.poetry.dependencies]
 python = ">=3.9,<3.13"
-# toml = "^0.10.2"
-# colorama = "*"
-# isoduration = "^20.11.0"
 jax = {version = "0.4.20", source = "jax-src"}
-toml = {version = "*", source = "explicit-src"}
+toml = {version = "^0.10.2", source = "explicit-src"}
 colorama = "*"
 
 

From 0caf4c99e190ec22495c7f6c670cf7289e76062a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 11 Nov 2023 13:10:52 +0100
Subject: [PATCH 078/155] tidy

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py                 |  12 +-
 cyclonedx_py/_internal/poetry.py              | 111 +++++++++---------
 cyclonedx_py/_internal/utils/args.py          |   4 +-
 cyclonedx_py/_internal/utils/pypi.py          |  18 ---
 tests/_data/infiles/poetry/TODO.txt           |   1 -
 .../poetry/private-packges/pypi-proxy.py      |   2 +-
 6 files changed, 68 insertions(+), 80 deletions(-)
 delete mode 100644 cyclonedx_py/_internal/utils/pypi.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 9493e67c..54cfe222 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -99,12 +99,13 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                             dest='validate',
                             action='store_false')
 
-        for sct, scc, scd in (
+        scbbc: Type['BomBuilder']
+        for sct, scbbc, scd in (  # type:ignore[assignment]
             ('requirements', RequirementsBB, 'HELP TODO'),
             ('pipenv', PipenvBB, 'HELP TODO'),
             ('poetry', PoetryBB, 'HELP TODO'),
         ):
-            spp = scc.make_argument_parser(add_help=False)
+            spp = scbbc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
                           help=scd,
                           description=spp.description,
@@ -112,7 +113,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                           parents=[spp, op, sco],
                           formatter_class=p.formatter_class,
                           allow_abbrev=p.allow_abbrev,
-                          ).set_defaults(bbc=scc)
+                          ).set_defaults(_bbc=scbbc)
 
         return p
 
@@ -127,13 +128,14 @@ def __init__(self, *,
                  validate: bool,
                  output_format: OutputFormat,
                  schema_version: SchemaVersion,
-                 bbc: Type['BomBuilder'],
+                 _bbc: Type['BomBuilder'],
                  **kwargs: Any) -> None:
         self._logger = logger
         self._output_format = output_format
         self._schema_version = schema_version
         self._validate = validate
-        self._bbc = bbc(logger=self._logger.getChild(bbc.__name__), **self._clean_kwargs(kwargs))
+        self._bbc = _bbc(**self._clean_kwargs(kwargs),
+                         logger=self._logger.getChild(_bbc.__name__))
 
     def validate(self, output: str) -> bool:
         if not self._validate:
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index bcca0bf3..36bfac36 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -19,7 +19,7 @@
 import re
 from enum import Enum
 from itertools import chain
-from typing import TYPE_CHECKING, Any, Dict, Generator, List, TextIO, Set, NamedTuple, Iterable, Optional
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, NamedTuple, Optional, Set
 
 from . import BomBuilder
 
@@ -27,7 +27,7 @@
     from argparse import ArgumentParser
     from logging import Logger
 
-    from cyclonedx.model import HashType
+    from cyclonedx.model import ExternalReference, HashType
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component, ComponentType
 
@@ -42,13 +42,22 @@ class _CdxProperty(Enum):
     PackageGroup = 'cdx:poetry:package:group'
 
 
+class _LockEntry(NamedTuple):
+    name: str
+    component: 'Component'
+    dependencies: Set[str]
+    extras: Dict[str, Set[str]]
+
+
 class PoetryBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import ArgumentParser, OPTIONAL
+        from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
+
         from cyclonedx.model.component import ComponentType
+
         from .utils.args import argparse_type4enum
 
         p = ArgumentParser(description=dedent('''\
@@ -59,27 +68,27 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                            **kwargs)
         # the args shall mimic the ones from Poetry, which uses comma-separated lists and multi-use
         p.add_argument('--without',
-                         metavar='GROUPS',
-                         help='The dependency groups to ignore (multiple values allowed)',
-                         action='append',
-                         dest='groups_without',
-                         default=[])
+                       metavar='GROUPS',
+                       help='The dependency groups to ignore (multiple values allowed)',
+                       action='append',
+                       dest='groups_without',
+                       default=[])
         p.add_argument('--with',
-                         metavar='GROUPS',
-                         help='The optional dependency groups to include (multiple values allowed)',
-                         action='append',
-                         dest='groups_with',
-                         default=[])
+                       metavar='GROUPS',
+                       help='The optional dependency groups to include (multiple values allowed)',
+                       action='append',
+                       dest='groups_with',
+                       default=[])
         p.add_argument('--only',
-                        metavar='GROUPS',
-                        help='The only dependency groups to include (multiple values allowed)',
-                        action='append',
-                        dest='groups_only',
-                        default=[])
+                       metavar='GROUPS',
+                       help='The only dependency groups to include (multiple values allowed)',
+                       action='append',
+                       dest='groups_only',
+                       default=[])
         p.add_argument('--no-dev',
-                        help='Explicitly force: --only main',
-                        dest='no_dev',
-                        action='store_true')
+                       help='Explicitly force: --only main',
+                       dest='no_dev',
+                       action='store_true')
         eg = p.add_mutually_exclusive_group()
         eg.add_argument('--extras',
                         metavar='EXTRAS',
@@ -124,8 +133,8 @@ def __call__(self, *,  # type:ignore[override]
                  extras: List[str], all_extras: bool,
                  mc_type: 'ComponentType',
                  **kwargs: Any) -> 'Bom':
-        from os.path import join
         import sys
+        from os.path import join
         if sys.version_info < (3, 11):
             from toml import loads as toml_loads
         else:
@@ -173,12 +182,6 @@ def __call__(self, *,  # type:ignore[override]
                 mc_type,
             )
 
-    class _LockEntry(NamedTuple):
-        name: str
-        component: 'Component'
-        dependencies: Set[str]
-        extras: Dict[str, Set[str]]
-
     def _make_bom(self, project: 'NameDict', locker: 'NameDict',
                   use_groups: Set[str], use_extras: Set[str],
                   mc_type: 'ComponentType') -> 'Bom':
@@ -196,7 +199,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
         bom.metadata.component = root_c = self.__component4poetryproj(po_cfg, mc_type)
         self._logger.debug('root-component: %r', root_c)
 
-        lock_data: Dict[str, self._LockEntry] = {le.name: le for le in self._parse_lock(locker)}
+        lock_data: Dict[str, _LockEntry] = {le.name: le for le in self._parse_lock(locker)}
 
         extra_deps = set(chain.from_iterable(
             eds for en, eds in po_cfg.get('extras', {}).items() if en in use_extras))
@@ -224,6 +227,8 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
             ):
                 self._logger.debug('component %r depends on %r', name, dep)
                 depm = _dep_pattern.match(dep)
+                if depm is None:
+                    continue
                 depends_on.append(_add_ld(
                     depm.group('name'),
                     set(map(str.strip, (depm.group('extras') or '').split(',')))
@@ -255,8 +260,9 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
         return bom
 
     def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') -> 'Component':
+        from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.factory.license import LicenseFactory
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri, InvalidUriException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
         from cyclonedx.model.component import Component
 
         # see spec: https://python-poetry.org/docs/pyproject/
@@ -302,7 +308,7 @@ def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
         package: 'NameDict'
         for package in locker['package']:
             package.setdefault('files', metavar_files.get(package['name'], []))
-            yield self._LockEntry(
+            yield _LockEntry(
                 package['name'],
                 self.__make_component4lock(package),
                 set(package.get('dependencies', {}).keys()),
@@ -324,20 +330,19 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
     def __make_component4lock(self, package: 'NameDict') -> 'Component':
         # TODO:
         #   - local deps
-        #   - private package
         #   - from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
 
-        from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
+        from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentScope
         from packageurl import PackageURL
 
-        component = Component(
+        return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
             name=package['name'],
             version=package['version'],
             description=package.get('description'),
             scope=ComponentScope.OPTIONAL if package.get('optional') else None,
+            external_references=self.__extrefs4lock(package),
             properties=filter(None, [
                 Property(  # for backwards compatibility: category -> group
                     name=_CdxProperty.PackageGroup.value,
@@ -346,22 +351,22 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
             ]),
             purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
         )
-        """TODO
-        fles and hashes eixts, regardless of the source ...
-        need to incorporate proper with URL/local files/ etc ...
 
-        package_host = 'https://files.pythonhosted.org'
-        for file in package.get('files', []):
-            try:
-                'hash' in file and component.external_references.add(ExternalReference(
-                    type=ExternalReferenceType.DISTRIBUTION,
-                    url=XsUri(
-                        # see https://warehouse.pypa.io/api-reference/integration-guide.html#predictable-urls
-                        f'{package_host}/packages/source/{component.name[0]}/{component.name}/{file["file"]}'),
-                    hashes=[HashType.from_composite_str(file["hash"])]
-                ))
-            except InvalidUriException as error:
-                self._logger.debug('%s skipped extRef for: %r', package['name'], file, exc_info=error)
-                del error
-        """
-        return component
+    def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+
+        source = package.get('source', {'type': 'legacy', 'url': 'https://pypi.org/simple'})
+        if source.get('type') == 'legacy' and source.get('url'):
+            for file in package.get('files', []):
+                try:
+                    yield ExternalReference(
+                        type=ExternalReferenceType.DISTRIBUTION,
+                        url=XsUri(f'{source["url"]}/{package["name"]}/'),
+                        comment=f'file: {file["file"]}',
+                        hashes=[HashType.from_composite_str(file['hash'])]
+                    )
+                except InvalidUriException as error:
+                    self._logger.debug('%s skipped dist-extRef for: %r', package['name'], file,
+                                       exc_info=error)
+                    del error
diff --git a/cyclonedx_py/_internal/utils/args.py b/cyclonedx_py/_internal/utils/args.py
index 378a533f..2eba3e8a 100644
--- a/cyclonedx_py/_internal/utils/args.py
+++ b/cyclonedx_py/_internal/utils/args.py
@@ -17,13 +17,13 @@
 
 
 from argparse import ArgumentTypeError
-from typing import Type, Callable, TypeVar
 from enum import Enum
+from typing import Callable, Type, TypeVar
 
 _E = TypeVar('_E', bound=Enum)
 
 
-def argparse_type4enum(enum: Type[_E]) -> Callable[str, _E]:
+def argparse_type4enum(enum: Type[_E]) -> Callable[[str], _E]:
     def str2case(value: str) -> _E:
         try:
             return enum[value.upper()]
diff --git a/cyclonedx_py/_internal/utils/pypi.py b/cyclonedx_py/_internal/utils/pypi.py
deleted file mode 100644
index 20222135..00000000
--- a/cyclonedx_py/_internal/utils/pypi.py
+++ /dev/null
@@ -1,18 +0,0 @@
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
diff --git a/tests/_data/infiles/poetry/TODO.txt b/tests/_data/infiles/poetry/TODO.txt
index 9073207b..434dd66b 100644
--- a/tests/_data/infiles/poetry/TODO.txt
+++ b/tests/_data/infiles/poetry/TODO.txt
@@ -1,4 +1,3 @@
 - local deps
-- private package
 - from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
 - extras , direct & transitive
diff --git a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
index 3788b301..654430f5 100755
--- a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
+++ b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
@@ -29,7 +29,7 @@
 
 
 class PypiProxyReqHandler(BaseHTTPRequestHandler):
-    def do_GET(self):
+    def do_GET(self) -> None:
         print('> ', self.path, file=sys.stderr)
         p, m = urlretrieve(f'https://pypi.org{self.path}')
         print('< ', p, file=sys.stderr)

From f8f509cddb12f03be523d8353bad0e4598fd3d31 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 11 Nov 2023 13:52:35 +0100
Subject: [PATCH 079/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              | 30 +++++++++----------
 .../regression-issue611/lock20/poetry.lock    |  1 +
 .../{ => lock20}/pyproject.toml               |  0
 .../regression-issue611-poetry.lock.bin       |  0
 tests/integration/test_poetry.py              | 20 +++++++------
 5 files changed, 27 insertions(+), 24 deletions(-)
 create mode 120000 tests/_data/infiles/poetry/regression-issue611/lock20/poetry.lock
 rename tests/_data/infiles/poetry/regression-issue611/{ => lock20}/pyproject.toml (100%)
 rename tests/_data/infiles/poetry/regression-issue611/{ => lock20}/regression-issue611-poetry.lock.bin (100%)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 36bfac36..a976099f 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -169,7 +169,6 @@ def __call__(self, *,  # type:ignore[override]
             else:
                 groups_with = ','.join(groups_with).split(',')
                 groups_without = ','.join(groups_without).split(',')
-                print(repr(po_cfg.get('group')))
                 groups = (set(groups_with) | set(
                     gn for gn, gc in po_cfg.get('group', {}).items()
                     if not gc.get('optional')
@@ -353,20 +352,21 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
         )
 
     def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException
+        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
 
         source = package.get('source', {'type': 'legacy', 'url': 'https://pypi.org/simple'})
-        if source.get('type') == 'legacy' and source.get('url'):
-            for file in package.get('files', []):
-                try:
-                    yield ExternalReference(
-                        type=ExternalReferenceType.DISTRIBUTION,
-                        url=XsUri(f'{source["url"]}/{package["name"]}/'),
-                        comment=f'file: {file["file"]}',
-                        hashes=[HashType.from_composite_str(file['hash'])]
-                    )
-                except InvalidUriException as error:
-                    self._logger.debug('%s skipped dist-extRef for: %r', package['name'], file,
-                                       exc_info=error)
-                    del error
+        if source.get('type') != 'legacy' or not source.get('url'):
+            return
+
+        for file in package.get('files', []):
+            try:
+                yield ExternalReference(
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(f'{source["url"]}/{package["name"]}/#{file["file"]}'),
+                    hashes=[HashType.from_composite_str(file['hash'])]
+                )
+            except (InvalidUriException, UnknownHashTypeException) as error:
+                self._logger.debug('%s skipped dist-extRef for: %r', package['name'], file,
+                                   exc_info=error)
+                del error
diff --git a/tests/_data/infiles/poetry/regression-issue611/lock20/poetry.lock b/tests/_data/infiles/poetry/regression-issue611/lock20/poetry.lock
new file mode 120000
index 00000000..0d698fcc
--- /dev/null
+++ b/tests/_data/infiles/poetry/regression-issue611/lock20/poetry.lock
@@ -0,0 +1 @@
+regression-issue611-poetry.lock.bin
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/regression-issue611/pyproject.toml b/tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml
similarity index 100%
rename from tests/_data/infiles/poetry/regression-issue611/pyproject.toml
rename to tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml
diff --git a/tests/_data/infiles/poetry/regression-issue611/regression-issue611-poetry.lock.bin b/tests/_data/infiles/poetry/regression-issue611/lock20/regression-issue611-poetry.lock.bin
similarity index 100%
rename from tests/_data/infiles/poetry/regression-issue611/regression-issue611-poetry.lock.bin
rename to tests/_data/infiles/poetry/regression-issue611/lock20/regression-issue611-poetry.lock.bin
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 2b95ff40..f2c0359c 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -19,7 +19,7 @@
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob
 from io import StringIO
-from os.path import basename, join
+from os.path import basename, dirname, join
 from unittest import TestCase
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
@@ -28,15 +28,17 @@
 from cyclonedx_py._internal.cli import run as run_cli
 from tests import INFILES_DIRECTORY, SnapshotMixin, make_comparable
 
-infiles = glob(join(INFILES_DIRECTORY, 'poetry', '*poetry.lock'))
+lockfiles = glob(join(INFILES_DIRECTORY, 'poetry', '*', '*', 'poetry.lock'))
+projectdirs = list(dirname(lockfile) for lockfile in lockfiles)
+
 unsupported_of_sf = [
     (OutputFormat.JSON, SchemaVersion.V1_1),
     (OutputFormat.JSON, SchemaVersion.V1_0),
 ]
 
 test_data = [
-    (f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of)
-    for infile in infiles
+    (f'{basename(dirname(projectdir))}-{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
+    for projectdir in projectdirs
     for sv in SchemaVersion
     for of in OutputFormat
     if (of, sv) not in unsupported_of_sf
@@ -61,10 +63,10 @@ def test_cli_with_file_not_found(self) -> None:
             err = err.getvalue()
             out = out.getvalue()
         self.assertNotEqual(0, res, err)
-        self.assertIn("No such file or directory: 'something-that-must-not-exist.testing'", err)
+        self.assertIn("No such file or directory: 'something-that-must-not-exist.testing", err)
 
-    @named_data(* test_data)
-    def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    @named_data(*test_data)
+    def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -75,13 +77,13 @@ def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: Out
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
                     '--outfile=-',
-                    infile])
+                    projectdir])
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
         self.assertEqualSnapshot(
             make_comparable(out, of),
-            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}-file')
+            f'{basename(dirname(projectdir))}-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
 
     def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
         super().assertEqualSnapshot(actual, join('poetry', snapshot_name))

From aefd9314955825a78157bf1d9acb4a81cc6d927f Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 11 Nov 2023 13:52:40 +0100
Subject: [PATCH 080/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../poetry/group-deps-lock11-1.0.xml.bin      |   61 +
 .../poetry/group-deps-lock11-1.1.xml.bin      |   53 +
 .../poetry/group-deps-lock11-1.2.json.bin     |  139 ++
 .../poetry/group-deps-lock11-1.2.xml.bin      |   96 ++
 .../poetry/group-deps-lock11-1.3.json.bin     |  199 +++
 .../poetry/group-deps-lock11-1.3.xml.bin      |  123 ++
 .../poetry/group-deps-lock11-1.4.json.bin     |  267 ++++
 .../poetry/group-deps-lock11-1.4.xml.bin      |  175 +++
 .../poetry/group-deps-lock20-1.0.xml.bin      |   61 +
 .../poetry/group-deps-lock20-1.1.xml.bin      |  117 ++
 .../poetry/group-deps-lock20-1.2.json.bin     |  219 ++++
 .../poetry/group-deps-lock20-1.2.xml.bin      |  160 +++
 .../poetry/group-deps-lock20-1.3.json.bin     |  375 ++++++
 .../poetry/group-deps-lock20-1.3.xml.bin      |  235 ++++
 .../poetry/group-deps-lock20-1.4.json.bin     |  443 +++++++
 .../poetry/group-deps-lock20-1.4.xml.bin      |  287 +++++
 .../poetry/main-and-dev-lock10-1.0.xml.bin    |   54 +
 .../poetry/main-and-dev-lock10-1.1.xml.bin    |   47 +
 .../poetry/main-and-dev-lock10-1.2.json.bin   |  127 ++
 .../poetry/main-and-dev-lock10-1.2.xml.bin    |   88 ++
 .../poetry/main-and-dev-lock10-1.3.json.bin   |  169 +++
 .../poetry/main-and-dev-lock10-1.3.xml.bin    |  109 ++
 .../poetry/main-and-dev-lock10-1.4.json.bin   |  237 ++++
 .../poetry/main-and-dev-lock10-1.4.xml.bin    |  161 +++
 .../poetry/main-and-dev-lock11-1.0.xml.bin    |   54 +
 .../poetry/main-and-dev-lock11-1.1.xml.bin    |   47 +
 .../poetry/main-and-dev-lock11-1.2.json.bin   |  127 ++
 .../poetry/main-and-dev-lock11-1.2.xml.bin    |   88 ++
 .../poetry/main-and-dev-lock11-1.3.json.bin   |  169 +++
 .../poetry/main-and-dev-lock11-1.3.xml.bin    |  109 ++
 .../poetry/main-and-dev-lock11-1.4.json.bin   |  237 ++++
 .../poetry/main-and-dev-lock11-1.4.xml.bin    |  161 +++
 .../poetry/main-and-dev-lock20-1.0.xml.bin    |   54 +
 .../poetry/main-and-dev-lock20-1.1.xml.bin    |  103 ++
 .../poetry/main-and-dev-lock20-1.2.json.bin   |  197 +++
 .../poetry/main-and-dev-lock20-1.2.xml.bin    |  144 +++
 .../poetry/main-and-dev-lock20-1.3.json.bin   |  299 +++++
 .../poetry/main-and-dev-lock20-1.3.xml.bin    |  195 +++
 .../poetry/main-and-dev-lock20-1.4.json.bin   |  367 ++++++
 .../poetry/main-and-dev-lock20-1.4.xml.bin    |  247 ++++
 .../poetry/private-packges-lock10-1.0.xml.bin |   19 +
 .../poetry/private-packges-lock10-1.1.xml.bin |   17 +
 .../private-packges-lock10-1.2.json.bin       |   61 +
 .../poetry/private-packges-lock10-1.2.xml.bin |   45 +
 .../private-packges-lock10-1.3.json.bin       |   73 ++
 .../poetry/private-packges-lock10-1.3.xml.bin |   51 +
 .../private-packges-lock10-1.4.json.bin       |  141 +++
 .../poetry/private-packges-lock10-1.4.xml.bin |  103 ++
 .../poetry/private-packges-lock11-1.0.xml.bin |   68 +
 .../poetry/private-packges-lock11-1.1.xml.bin |   59 +
 .../private-packges-lock11-1.2.json.bin       |  158 +++
 .../poetry/private-packges-lock11-1.2.xml.bin |  109 ++
 .../private-packges-lock11-1.3.json.bin       |  212 ++++
 .../poetry/private-packges-lock11-1.3.xml.bin |  136 ++
 .../private-packges-lock11-1.4.json.bin       |  280 ++++
 .../poetry/private-packges-lock11-1.4.xml.bin |  188 +++
 .../poetry/private-packges-lock20-1.0.xml.bin |   68 +
 .../poetry/private-packges-lock20-1.1.xml.bin |  335 +++++
 .../private-packges-lock20-1.2.json.bin       |  520 ++++++++
 .../poetry/private-packges-lock20-1.2.xml.bin |  385 ++++++
 .../private-packges-lock20-1.3.json.bin       | 1054 ++++++++++++++++
 .../poetry/private-packges-lock20-1.3.xml.bin |  652 ++++++++++
 .../private-packges-lock20-1.4.json.bin       | 1122 +++++++++++++++++
 .../poetry/private-packges-lock20-1.4.xml.bin |  704 +++++++++++
 .../regression-issue611-lock20-1.0.xml.bin    |   12 +
 .../regression-issue611-lock20-1.1.xml.bin    |   19 +
 .../regression-issue611-lock20-1.2.json.bin   |   59 +
 .../regression-issue611-lock20-1.2.xml.bin    |   45 +
 .../regression-issue611-lock20-1.3.json.bin   |   77 ++
 .../regression-issue611-lock20-1.3.xml.bin    |   54 +
 .../regression-issue611-lock20-1.4.json.bin   |  145 +++
 .../regression-issue611-lock20-1.4.xml.bin    |  106 ++
 72 files changed, 13677 insertions(+)
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin

diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin
new file mode 100644
index 00000000..507a3485
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin
@@ -0,0 +1,61 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
new file mode 100644
index 00000000..e7aea997
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
new file mode 100644
index 00000000..82845bb7
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
@@ -0,0 +1,139 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "ddt@1.6.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
new file mode 100644
index 00000000..abc3a0b8
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
@@ -0,0 +1,96 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
new file mode 100644
index 00000000..cb2f30f1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
@@ -0,0 +1,199 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "ddt@1.6.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
new file mode 100644
index 00000000..b6ed7521
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
@@ -0,0 +1,123 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+        <property name="cdx:poetry:package:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
new file mode 100644
index 00000000..45cfb243
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
@@ -0,0 +1,267 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "ddt@1.6.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
new file mode 100644
index 00000000..fccfa652
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
@@ -0,0 +1,175 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+        <property name="cdx:poetry:package:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin
new file mode 100644
index 00000000..507a3485
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin
@@ -0,0 +1,61 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
new file mode 100644
index 00000000..14e0000c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
@@ -0,0 +1,117 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
new file mode 100644
index 00000000..b587fc62
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
@@ -0,0 +1,219 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "ddt@1.6.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
new file mode 100644
index 00000000..e92e9116
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
@@ -0,0 +1,160 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
new file mode 100644
index 00000000..e7a74cf3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
@@ -0,0 +1,375 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "ddt@1.6.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
new file mode 100644
index 00000000..4b8a190e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
@@ -0,0 +1,235 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+        <property name="cdx:poetry:package:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
new file mode 100644
index 00000000..2e3f20bb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
@@ -0,0 +1,443 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt@1.6.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.6.0",
+      "type": "library",
+      "version": "1.6.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupA"
+        },
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "ref": "ddt@1.6.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "ddt@1.6.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
new file mode 100644
index 00000000..20ae6173
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
@@ -0,0 +1,287 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.6.0">
+      <name>ddt</name>
+      <version>1.6.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:package:group">groupA</property>
+        <property name="cdx:poetry:package:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.0.xml.bin
new file mode 100644
index 00000000..09a1966e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.0.xml.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin
new file mode 100644
index 00000000..3a5f5dfc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
new file mode 100644
index 00000000..959bc08b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
@@ -0,0 +1,127 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
new file mode 100644
index 00000000..748d68ac
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
@@ -0,0 +1,88 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
new file mode 100644
index 00000000..d89d6d9b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
@@ -0,0 +1,169 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
new file mode 100644
index 00000000..b4a855bc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
@@ -0,0 +1,109 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
new file mode 100644
index 00000000..662174cf
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
@@ -0,0 +1,237 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
new file mode 100644
index 00000000..f5765f81
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
@@ -0,0 +1,161 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.0.xml.bin
new file mode 100644
index 00000000..09a1966e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.0.xml.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin
new file mode 100644
index 00000000..3a5f5dfc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
new file mode 100644
index 00000000..959bc08b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
@@ -0,0 +1,127 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
new file mode 100644
index 00000000..748d68ac
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
@@ -0,0 +1,88 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
new file mode 100644
index 00000000..d89d6d9b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
@@ -0,0 +1,169 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
new file mode 100644
index 00000000..b4a855bc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
@@ -0,0 +1,109 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
new file mode 100644
index 00000000..662174cf
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
@@ -0,0 +1,237 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
new file mode 100644
index 00000000..f5765f81
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
@@ -0,0 +1,161 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.0.xml.bin
new file mode 100644
index 00000000..09a1966e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.0.xml.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin
new file mode 100644
index 00000000..0516f8eb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin
@@ -0,0 +1,103 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
new file mode 100644
index 00000000..520aa163
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
@@ -0,0 +1,197 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
new file mode 100644
index 00000000..b0c2ec69
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
@@ -0,0 +1,144 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
new file mode 100644
index 00000000..590d73c1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
@@ -0,0 +1,299 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
new file mode 100644
index 00000000..00fd5651
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
@@ -0,0 +1,195 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
new file mode 100644
index 00000000..47d6e8c5
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
@@ -0,0 +1,367 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
new file mode 100644
index 00000000..020245fc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
@@ -0,0 +1,247 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin
new file mode 100644
index 00000000..efa54d7b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin
@@ -0,0 +1,19 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
new file mode 100644
index 00000000..fc1020b9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
new file mode 100644
index 00000000..07ae0b30
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
@@ -0,0 +1,61 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
new file mode 100644
index 00000000..386c79ec
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
@@ -0,0 +1,45 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
new file mode 100644
index 00000000..e8d39d2a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
@@ -0,0 +1,73 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
new file mode 100644
index 00000000..35774798
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
@@ -0,0 +1,51 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
new file mode 100644
index 00000000..a7e5159e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
@@ -0,0 +1,141 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
new file mode 100644
index 00000000..4385964f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
@@ -0,0 +1,103 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin
new file mode 100644
index 00000000..55f6597d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin
@@ -0,0 +1,68 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
new file mode 100644
index 00000000..f9a40645
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
@@ -0,0 +1,59 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
new file mode 100644
index 00000000..5bf04e96
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
@@ -0,0 +1,158 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "name": "importlib-metadata",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "name": "jax",
+      "purl": "pkg:pypi/jax@0.4.20",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "name": "ml-dtypes",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.26.1",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "name": "opt-einsum",
+      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "name": "scipy",
+      "purl": "pkg:pypi/scipy@1.11.3",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
new file mode 100644
index 00000000..f89e526c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
@@ -0,0 +1,109 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
new file mode 100644
index 00000000..df312f29
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
@@ -0,0 +1,212 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "name": "importlib-metadata",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "name": "jax",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jax@0.4.20",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "name": "ml-dtypes",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.1",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "name": "opt-einsum",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "name": "scipy",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/scipy@1.11.3",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "name": "zipp",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
new file mode 100644
index 00000000..3c412755
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
@@ -0,0 +1,136 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
new file mode 100644
index 00000000..fd2ad230
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
@@ -0,0 +1,280 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "name": "importlib-metadata",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "name": "jax",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jax@0.4.20",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "name": "ml-dtypes",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.1",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "name": "opt-einsum",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "name": "scipy",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/scipy@1.11.3",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "name": "zipp",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
new file mode 100644
index 00000000..c25fe55b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
@@ -0,0 +1,188 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin
new file mode 100644
index 00000000..55f6597d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin
@@ -0,0 +1,68 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
new file mode 100644
index 00000000..9448b225
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
@@ -0,0 +1,335 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
new file mode 100644
index 00000000..3a54e9ad
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
@@ -0,0 +1,520 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
+      "name": "importlib-metadata",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
+      "name": "jax",
+      "purl": "pkg:pypi/jax@0.4.20",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
+      "name": "ml-dtypes",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.26.1",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
+      "name": "opt-einsum",
+      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
+      "name": "scipy",
+      "purl": "pkg:pypi/scipy@1.11.3",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
new file mode 100644
index 00000000..f2ee1ac2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
@@ -0,0 +1,385 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
new file mode 100644
index 00000000..795fccc1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
@@ -0,0 +1,1054 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
+      "name": "importlib-metadata",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
+      "name": "jax",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jax@0.4.20",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
+      "name": "ml-dtypes",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.26.1",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
+      "name": "opt-einsum",
+      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
+      "name": "scipy",
+      "purl": "pkg:pypi/scipy@1.11.3",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
new file mode 100644
index 00000000..94c6be8c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
@@ -0,0 +1,652 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
new file mode 100644
index 00000000..8c93cd91
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
@@ -0,0 +1,1122 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
+      "name": "importlib-metadata",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
+      "name": "jax",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jax@0.4.20",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
+      "name": "ml-dtypes",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.26.1",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
+      "name": "opt-einsum",
+      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
+      "name": "scipy",
+      "purl": "pkg:pypi/scipy@1.11.3",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
new file mode 100644
index 00000000..b587600e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
@@ -0,0 +1,704 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.0.xml.bin
new file mode 100644
index 00000000..3810a1e9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>pyhumps</name>
+      <version>3.7.1</version>
+      <description>🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node</description>
+      <purl>pkg:pypi/pyhumps@3.7.1</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin
new file mode 100644
index 00000000..24359e43
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin
@@ -0,0 +1,19 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="pyhumps@3.7.1">
+      <name>pyhumps</name>
+      <version>3.7.1</version>
+      <description>🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node</description>
+      <purl>pkg:pypi/pyhumps@3.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
new file mode 100644
index 00000000..a2ab60fc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
@@ -0,0 +1,59 @@
+{
+  "components": [
+    {
+      "bom-ref": "pyhumps@3.7.1",
+      "description": "\ud83d\udc2b  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz"
+        }
+      ],
+      "name": "pyhumps",
+      "purl": "pkg:pypi/pyhumps@3.7.1",
+      "type": "library",
+      "version": "3.7.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pyhumps@3.7.1"
+    },
+    {
+      "dependsOn": [
+        "pyhumps@3.7.1"
+      ],
+      "ref": "regression-issue611"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "regression-issue611",
+      "description": "regression for issue #611",
+      "name": "regression-issue611",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
new file mode 100644
index 00000000..f410bb0b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
@@ -0,0 +1,45 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="regression-issue611">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>regression-issue611</name>
+      <version>0.1.0</version>
+      <description>regression for issue #611</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="pyhumps@3.7.1">
+      <name>pyhumps</name>
+      <version>3.7.1</version>
+      <description>🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node</description>
+      <purl>pkg:pypi/pyhumps@3.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="pyhumps@3.7.1"/>
+    <dependency ref="regression-issue611">
+      <dependency ref="pyhumps@3.7.1"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
new file mode 100644
index 00000000..e0a4f158
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
@@ -0,0 +1,77 @@
+{
+  "components": [
+    {
+      "bom-ref": "pyhumps@3.7.1",
+      "description": "\ud83d\udc2b  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz"
+        }
+      ],
+      "name": "pyhumps",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/pyhumps@3.7.1",
+      "type": "library",
+      "version": "3.7.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pyhumps@3.7.1"
+    },
+    {
+      "dependsOn": [
+        "pyhumps@3.7.1"
+      ],
+      "ref": "regression-issue611"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "regression-issue611",
+      "description": "regression for issue #611",
+      "name": "regression-issue611",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
new file mode 100644
index 00000000..5073f033
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="regression-issue611">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>regression-issue611</name>
+      <version>0.1.0</version>
+      <description>regression for issue #611</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="pyhumps@3.7.1">
+      <name>pyhumps</name>
+      <version>3.7.1</version>
+      <description>🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node</description>
+      <purl>pkg:pypi/pyhumps@3.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="pyhumps@3.7.1"/>
+    <dependency ref="regression-issue611">
+      <dependency ref="pyhumps@3.7.1"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
new file mode 100644
index 00000000..6f7ee009
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
@@ -0,0 +1,145 @@
+{
+  "components": [
+    {
+      "bom-ref": "pyhumps@3.7.1",
+      "description": "\ud83d\udc2b  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz"
+        }
+      ],
+      "name": "pyhumps",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/pyhumps@3.7.1",
+      "type": "library",
+      "version": "3.7.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pyhumps@3.7.1"
+    },
+    {
+      "dependsOn": [
+        "pyhumps@3.7.1"
+      ],
+      "ref": "regression-issue611"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "regression-issue611",
+      "description": "regression for issue #611",
+      "name": "regression-issue611",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-bom/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
+          }
+        ],
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
new file mode 100644
index 00000000..0aac5295
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="regression-issue611">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>regression-issue611</name>
+      <version>0.1.0</version>
+      <description>regression for issue #611</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="pyhumps@3.7.1">
+      <name>pyhumps</name>
+      <version>3.7.1</version>
+      <description>🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node</description>
+      <purl>pkg:pypi/pyhumps@3.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="pyhumps@3.7.1"/>
+    <dependency ref="regression-issue611">
+      <dependency ref="pyhumps@3.7.1"/>
+    </dependency>
+  </dependencies>
+</bom>

From 9531cd92636a1bf1ba3e16e956fef8ac194c79b1 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 11 Nov 2023 14:14:29 +0100
Subject: [PATCH 081/155] tests

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/__init__.py                             |  8 +-
 .../poetry/group-deps-lock11-1.2.json.bin     |  2 +-
 .../poetry/group-deps-lock11-1.2.xml.bin      |  2 +-
 .../poetry/group-deps-lock11-1.3.json.bin     |  2 +-
 .../poetry/group-deps-lock11-1.3.xml.bin      |  2 +-
 .../poetry/group-deps-lock11-1.4.json.bin     | 74 +------------------
 .../poetry/group-deps-lock11-1.4.xml.bin      | 27 +------
 .../poetry/group-deps-lock20-1.2.json.bin     |  2 +-
 .../poetry/group-deps-lock20-1.2.xml.bin      |  2 +-
 .../poetry/group-deps-lock20-1.3.json.bin     |  2 +-
 .../poetry/group-deps-lock20-1.3.xml.bin      |  2 +-
 .../poetry/group-deps-lock20-1.4.json.bin     | 74 +------------------
 .../poetry/group-deps-lock20-1.4.xml.bin      | 27 +------
 .../poetry/main-and-dev-lock10-1.2.json.bin   |  2 +-
 .../poetry/main-and-dev-lock10-1.2.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock10-1.3.json.bin   |  2 +-
 .../poetry/main-and-dev-lock10-1.3.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock10-1.4.json.bin   | 74 +------------------
 .../poetry/main-and-dev-lock10-1.4.xml.bin    | 27 +------
 .../poetry/main-and-dev-lock11-1.2.json.bin   |  2 +-
 .../poetry/main-and-dev-lock11-1.2.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock11-1.3.json.bin   |  2 +-
 .../poetry/main-and-dev-lock11-1.3.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock11-1.4.json.bin   | 74 +------------------
 .../poetry/main-and-dev-lock11-1.4.xml.bin    | 27 +------
 .../poetry/main-and-dev-lock20-1.2.json.bin   |  2 +-
 .../poetry/main-and-dev-lock20-1.2.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock20-1.3.json.bin   |  2 +-
 .../poetry/main-and-dev-lock20-1.3.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock20-1.4.json.bin   | 74 +------------------
 .../poetry/main-and-dev-lock20-1.4.xml.bin    | 27 +------
 .../private-packges-lock10-1.2.json.bin       |  2 +-
 .../poetry/private-packges-lock10-1.2.xml.bin |  2 +-
 .../private-packges-lock10-1.3.json.bin       |  2 +-
 .../poetry/private-packges-lock10-1.3.xml.bin |  2 +-
 .../private-packges-lock10-1.4.json.bin       | 74 +------------------
 .../poetry/private-packges-lock10-1.4.xml.bin | 27 +------
 .../private-packges-lock11-1.2.json.bin       |  2 +-
 .../poetry/private-packges-lock11-1.2.xml.bin |  2 +-
 .../private-packges-lock11-1.3.json.bin       |  2 +-
 .../poetry/private-packges-lock11-1.3.xml.bin |  2 +-
 .../private-packges-lock11-1.4.json.bin       | 74 +------------------
 .../poetry/private-packges-lock11-1.4.xml.bin | 27 +------
 .../private-packges-lock20-1.2.json.bin       |  2 +-
 .../poetry/private-packges-lock20-1.2.xml.bin |  2 +-
 .../private-packges-lock20-1.3.json.bin       |  2 +-
 .../poetry/private-packges-lock20-1.3.xml.bin |  2 +-
 .../private-packges-lock20-1.4.json.bin       | 74 +------------------
 .../poetry/private-packges-lock20-1.4.xml.bin | 27 +------
 .../regression-issue611-lock20-1.2.json.bin   |  2 +-
 .../regression-issue611-lock20-1.2.xml.bin    |  2 +-
 .../regression-issue611-lock20-1.3.json.bin   |  2 +-
 .../regression-issue611-lock20-1.3.xml.bin    |  2 +-
 .../regression-issue611-lock20-1.4.json.bin   | 74 +------------------
 .../regression-issue611-lock20-1.4.xml.bin    | 27 +------
 .../requirements/frozen.txt-1.2.json-file.bin |  2 +-
 .../frozen.txt-1.2.json-stream.bin            |  2 +-
 .../requirements/frozen.txt-1.2.xml-file.bin  |  2 +-
 .../frozen.txt-1.2.xml-stream.bin             |  2 +-
 .../requirements/frozen.txt-1.3.json-file.bin |  2 +-
 .../frozen.txt-1.3.json-stream.bin            |  2 +-
 .../requirements/frozen.txt-1.3.xml-file.bin  |  2 +-
 .../frozen.txt-1.3.xml-stream.bin             |  2 +-
 .../requirements/frozen.txt-1.4.json-file.bin | 74 +------------------
 .../frozen.txt-1.4.json-stream.bin            | 74 +------------------
 .../requirements/frozen.txt-1.4.xml-file.bin  | 27 +------
 .../frozen.txt-1.4.xml-stream.bin             | 27 +------
 .../requirements/local.txt-1.2.json-file.bin  |  2 +-
 .../local.txt-1.2.json-stream.bin             |  2 +-
 .../requirements/local.txt-1.2.xml-file.bin   |  2 +-
 .../requirements/local.txt-1.2.xml-stream.bin |  2 +-
 .../requirements/local.txt-1.3.json-file.bin  |  2 +-
 .../local.txt-1.3.json-stream.bin             |  2 +-
 .../requirements/local.txt-1.3.xml-file.bin   |  2 +-
 .../requirements/local.txt-1.3.xml-stream.bin |  2 +-
 .../requirements/local.txt-1.4.json-file.bin  | 74 +------------------
 .../local.txt-1.4.json-stream.bin             | 74 +------------------
 .../requirements/local.txt-1.4.xml-file.bin   | 27 +------
 .../requirements/local.txt-1.4.xml-stream.bin | 27 +------
 .../requirements/nested.txt-1.2.json-file.bin |  2 +-
 .../nested.txt-1.2.json-stream.bin            |  2 +-
 .../requirements/nested.txt-1.2.xml-file.bin  |  2 +-
 .../nested.txt-1.2.xml-stream.bin             |  2 +-
 .../requirements/nested.txt-1.3.json-file.bin |  2 +-
 .../nested.txt-1.3.json-stream.bin            |  2 +-
 .../requirements/nested.txt-1.3.xml-file.bin  |  2 +-
 .../nested.txt-1.3.xml-stream.bin             |  2 +-
 .../requirements/nested.txt-1.4.json-file.bin | 74 +------------------
 .../nested.txt-1.4.json-stream.bin            | 74 +------------------
 .../requirements/nested.txt-1.4.xml-file.bin  | 27 +------
 .../nested.txt-1.4.xml-stream.bin             | 27 +------
 .../private-packages.txt-1.2.json-file.bin    |  2 +-
 .../private-packages.txt-1.2.json-stream.bin  |  2 +-
 .../private-packages.txt-1.2.xml-file.bin     |  2 +-
 .../private-packages.txt-1.2.xml-stream.bin   |  2 +-
 .../private-packages.txt-1.3.json-file.bin    |  2 +-
 .../private-packages.txt-1.3.json-stream.bin  |  2 +-
 .../private-packages.txt-1.3.xml-file.bin     |  2 +-
 .../private-packages.txt-1.3.xml-stream.bin   |  2 +-
 .../private-packages.txt-1.4.json-file.bin    | 74 +------------------
 .../private-packages.txt-1.4.json-stream.bin  | 74 +------------------
 .../private-packages.txt-1.4.xml-file.bin     | 27 +------
 .../private-packages.txt-1.4.xml-stream.bin   | 27 +------
 ...ssue448.cp1252.txt.bin-1.2.json-stream.bin |  2 +-
 ...issue448.cp1252.txt.bin-1.2.xml-stream.bin |  2 +-
 ...ssue448.cp1252.txt.bin-1.3.json-stream.bin |  2 +-
 ...issue448.cp1252.txt.bin-1.3.xml-stream.bin |  2 +-
 ...ssue448.cp1252.txt.bin-1.4.json-stream.bin | 74 +------------------
 ...issue448.cp1252.txt.bin-1.4.xml-stream.bin | 27 +------
 .../with-comments.txt-1.2.json-file.bin       |  2 +-
 .../with-comments.txt-1.2.json-stream.bin     |  2 +-
 .../with-comments.txt-1.2.xml-file.bin        |  2 +-
 .../with-comments.txt-1.2.xml-stream.bin      |  2 +-
 .../with-comments.txt-1.3.json-file.bin       |  2 +-
 .../with-comments.txt-1.3.json-stream.bin     |  2 +-
 .../with-comments.txt-1.3.xml-file.bin        |  2 +-
 .../with-comments.txt-1.3.xml-stream.bin      |  2 +-
 .../with-comments.txt-1.4.json-file.bin       | 74 +------------------
 .../with-comments.txt-1.4.json-stream.bin     | 74 +------------------
 .../with-comments.txt-1.4.xml-file.bin        | 27 +------
 .../with-comments.txt-1.4.xml-stream.bin      | 27 +------
 .../with-hashes.txt-1.2.json-file.bin         |  2 +-
 .../with-hashes.txt-1.2.json-stream.bin       |  2 +-
 .../with-hashes.txt-1.2.xml-file.bin          |  2 +-
 .../with-hashes.txt-1.2.xml-stream.bin        |  2 +-
 .../with-hashes.txt-1.3.json-file.bin         |  2 +-
 .../with-hashes.txt-1.3.json-stream.bin       |  2 +-
 .../with-hashes.txt-1.3.xml-file.bin          |  2 +-
 .../with-hashes.txt-1.3.xml-stream.bin        |  2 +-
 .../with-hashes.txt-1.4.json-file.bin         | 74 +------------------
 .../with-hashes.txt-1.4.json-stream.bin       | 74 +------------------
 .../with-hashes.txt-1.4.xml-file.bin          | 27 +------
 .../with-hashes.txt-1.4.xml-stream.bin        | 27 +------
 .../with-urls.txt-1.2.json-file.bin           |  2 +-
 .../with-urls.txt-1.2.json-stream.bin         |  2 +-
 .../with-urls.txt-1.2.xml-file.bin            |  2 +-
 .../with-urls.txt-1.2.xml-stream.bin          |  2 +-
 .../with-urls.txt-1.3.json-file.bin           |  2 +-
 .../with-urls.txt-1.3.json-stream.bin         |  2 +-
 .../with-urls.txt-1.3.xml-file.bin            |  2 +-
 .../with-urls.txt-1.3.xml-stream.bin          |  2 +-
 .../with-urls.txt-1.4.json-file.bin           | 74 +------------------
 .../with-urls.txt-1.4.json-stream.bin         | 74 +------------------
 .../with-urls.txt-1.4.xml-file.bin            | 27 +------
 .../with-urls.txt-1.4.xml-stream.bin          | 27 +------
 ...hout-pinned-versions.txt-1.2.json-file.bin |  2 +-
 ...ut-pinned-versions.txt-1.2.json-stream.bin |  2 +-
 ...thout-pinned-versions.txt-1.2.xml-file.bin |  2 +-
 ...out-pinned-versions.txt-1.2.xml-stream.bin |  2 +-
 ...hout-pinned-versions.txt-1.3.json-file.bin |  2 +-
 ...ut-pinned-versions.txt-1.3.json-stream.bin |  2 +-
 ...thout-pinned-versions.txt-1.3.xml-file.bin |  2 +-
 ...out-pinned-versions.txt-1.3.xml-stream.bin |  2 +-
 ...hout-pinned-versions.txt-1.4.json-file.bin | 74 +------------------
 ...ut-pinned-versions.txt-1.4.json-stream.bin | 74 +------------------
 ...thout-pinned-versions.txt-1.4.xml-file.bin | 27 +------
 ...out-pinned-versions.txt-1.4.xml-stream.bin | 27 +------
 157 files changed, 162 insertions(+), 2680 deletions(-)

diff --git a/tests/__init__.py b/tests/__init__.py
index 5534bfb7..6f1eef2c 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -81,10 +81,12 @@ def make_xml_comparable(bom: str) -> str:
     bom = re.sub(  # replace metadata.tools.version
         '        <vendor>CycloneDX</vendor>\n'
         '        <name>cyclonedx-python-lib</name>\n'
-        '        <version>.*?</version>',
+        '        <version>.*?</version>\n'
+        r'        <externalReferences>[\s\S]*?</externalReferences>',
         '        <vendor>CycloneDX</vendor>\n'
         '        <name>cyclonedx-python-lib</name>\n'
-        '        <version>libVersion-testing</version>',
+        '        <version>libVersion-testing</version>\n'
+        '        <externalReferences><!-- stripped --></externalReferences>',
         bom)
     return bom
 
@@ -99,9 +101,11 @@ def make_json_comparable(bom: str) -> str:
         '        "vendor": "CycloneDX",\n'
         '        "version": "thisVersion-testing"')
     bom = re.sub(  # replace metadata.tools.version
+        r'        "externalReferences": \[[\s\S]*?\],\n'
         '        "name": "cyclonedx-python-lib",\n'
         '        "vendor": "CycloneDX",\n'
         '        "version": ".*?"',
+        '        "externalReferences": [   ],\n'
         '        "name": "cyclonedx-python-lib",\n'
         '        "vendor": "CycloneDX",\n'
         '        "version": "libVersion-testing"',
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
index 82845bb7..20e853fa 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
@@ -128,7 +128,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
index abc3a0b8..1723151f 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
index cb2f30f1..d50eee2d 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
@@ -188,7 +188,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
index b6ed7521..11c256c2 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
index 45cfb243..30b781b6 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
@@ -181,79 +181,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
index fccfa652..62e4f877 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
index b587fc62..fce62210 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
@@ -208,7 +208,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
index e92e9116..720e6702 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
index e7a74cf3..830c0f98 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
@@ -364,7 +364,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
index 4b8a190e..131e9f9e 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
index 2e3f20bb..bbc1bf14 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
@@ -357,79 +357,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
index 20ae6173..b70a8a19 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
index 959bc08b..cd9b51a5 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
@@ -116,7 +116,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
index 748d68ac..02190713 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
index d89d6d9b..c52e8a5b 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
@@ -158,7 +158,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
index b4a855bc..afa8c4f9 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
index 662174cf..00bec73c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
@@ -151,79 +151,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
index f5765f81..5e739737 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
index 959bc08b..cd9b51a5 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
@@ -116,7 +116,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
index 748d68ac..02190713 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
index d89d6d9b..c52e8a5b 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
@@ -158,7 +158,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
index b4a855bc..afa8c4f9 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
index 662174cf..00bec73c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
@@ -151,79 +151,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
index f5765f81..5e739737 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
index 520aa163..92edb9a3 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
@@ -186,7 +186,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
index b0c2ec69..fde5b2e0 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
index 590d73c1..ca70f87c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
@@ -288,7 +288,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
index 00fd5651..19e6e859 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
index 47d6e8c5..6fe26a51 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
@@ -281,79 +281,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
index 020245fc..2a29fa22 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
index 07ae0b30..951eb36d 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
@@ -50,7 +50,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
index 386c79ec..8feee35a 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
index e8d39d2a..9996f9b5 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
@@ -62,7 +62,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
index 35774798..648859e4 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
index a7e5159e..8449718c 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
@@ -55,79 +55,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
index 4385964f..2e7f8ea1 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
index 5bf04e96..66fdf656 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
@@ -147,7 +147,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
index f89e526c..87ec2d77 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
index df312f29..06a9f094 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
@@ -201,7 +201,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
index 3c412755..647ec6e1 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
index fd2ad230..6db9ce27 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
@@ -194,79 +194,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
index c25fe55b..db7d9c2d 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
index 3a54e9ad..a89b75b6 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
@@ -509,7 +509,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
index f2ee1ac2..2d002503 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
index 795fccc1..09771000 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
@@ -1043,7 +1043,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
index 94c6be8c..9f11da37 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
index 8c93cd91..03fef41d 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
@@ -1036,79 +1036,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
index b587600e..eaaba592 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
index a2ab60fc..f6b447f0 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
@@ -48,7 +48,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
index f410bb0b..905be3e7 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
index e0a4f158..23557569 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
@@ -66,7 +66,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
index 5073f033..f1f0b423 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
index 6f7ee009..84f4560a 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
@@ -59,79 +59,7 @@
     },
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
index 0aac5295..b0fab01b 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
index 54b59ce1..ca7ee20f 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
@@ -49,7 +49,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
index 54b59ce1..ca7ee20f 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
@@ -49,7 +49,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
index 0bb8014a..1051b9e9 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
index 0bb8014a..1051b9e9 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
index 721c5238..4d0212bb 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
@@ -59,7 +59,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
index 721c5238..4d0212bb 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
@@ -59,7 +59,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
index c5c0f0dd..396435d8 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
index c5c0f0dd..396435d8 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
index ab9765f0..017055f9 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
@@ -52,79 +52,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
index ab9765f0..017055f9 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
@@ -52,79 +52,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
index c0acda5a..d0e82183 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
index c0acda5a..d0e82183 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
index 93744060..28afbbf7 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
@@ -115,7 +115,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
index 93744060..28afbbf7 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
@@ -115,7 +115,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
index 30ea9c4d..00cc452e 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
index 30ea9c4d..00cc452e 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
index 1eb4b4c8..d0f16b79 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
@@ -121,7 +121,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
index 1eb4b4c8..d0f16b79 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
@@ -121,7 +121,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
index fb576405..85af74a9 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
index fb576405..85af74a9 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
index 86171b8d..9e461821 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
@@ -109,79 +109,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
index 86171b8d..9e461821 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
@@ -109,79 +109,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
index 041f015c..02871a38 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
index 041f015c..02871a38 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
index 54b59ce1..ca7ee20f 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
@@ -49,7 +49,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
index 6dcf4e3f..95434d63 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
@@ -9,7 +9,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
index 0bb8014a..1051b9e9 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
index d91fc191..3fd91730 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
index 721c5238..4d0212bb 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
@@ -59,7 +59,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
index ae6bb18c..23e46376 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
@@ -9,7 +9,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
index c5c0f0dd..396435d8 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
index 77546d46..f8498cd3 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
index ab9765f0..017055f9 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
@@ -52,79 +52,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin
index ec7c189e..0ca4ef15 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin
@@ -2,79 +2,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
index c0acda5a..d0e82183 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin
index 50420a76..27fa7639 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
index 9430918e..b5e84886 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
index 9430918e..b5e84886 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
index 2cf41d2c..99f2defa 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
index 2cf41d2c..99f2defa 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
index acfb396c..11ba5cfe 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
index acfb396c..11ba5cfe 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
index 0fd61ff9..3cd4c3d7 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
index 0fd61ff9..3cd4c3d7 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
index a7891db8..1ca174e5 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
@@ -34,79 +34,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
index a7891db8..1ca174e5 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
@@ -34,79 +34,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
index 09e4f8cd..1c749b7d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
index 09e4f8cd..1c749b7d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
index 5ab249db..36834eac 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
index 79629f3e..1ca5c82f 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
index 33edf346..17a92546 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
index c0227f2c..b6e887b0 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
index da59867a..07dc044d 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
@@ -57,79 +57,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
index 166edddb..39b06991 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
index a4ebb28b..1d8a3bfa 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
index a4ebb28b..1d8a3bfa 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
index b1706738..abad28a2 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
index b1706738..abad28a2 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
index 6f64580d..1768bb4b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
index 6f64580d..1768bb4b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
index e16dafc2..0be53e34 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
index e16dafc2..0be53e34 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
index 62bd66cc..9e2a8e28 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
@@ -96,79 +96,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
index 62bd66cc..9e2a8e28 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
@@ -96,79 +96,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
index 0ac47c5b..743ded61 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
index 0ac47c5b..743ded61 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
index 7e512e46..c711fdf5 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
@@ -85,7 +85,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
index 7e512e46..c711fdf5 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
@@ -85,7 +85,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
index 2c51553e..f5b8a454 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
index 2c51553e..f5b8a454 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
index 5a434426..b9633275 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
@@ -115,7 +115,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
index 5a434426..b9633275 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
@@ -115,7 +115,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
index 7abf55ed..1e4580e5 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
index 7abf55ed..1e4580e5 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
index 745f68a2..b6701fa6 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
@@ -107,79 +107,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
index 745f68a2..b6701fa6 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
@@ -107,79 +107,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
index 5cd0df6a..8301d74c 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
index 5cd0df6a..8301d74c 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
index 6a2396bd..09d3d19c 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
index 6a2396bd..09d3d19c 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
index 9e67b581..7535c2ba 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
index 9e67b581..7535c2ba 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
index ab5d1242..a9602337 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
index ab5d1242..a9602337 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
index ee1b960c..f628d99b 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
index ee1b960c..f628d99b 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
index f93737d1..b60d3a46 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
@@ -125,79 +125,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
index f93737d1..b60d3a46 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
@@ -125,79 +125,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
index 49d74201..0563d7c4 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
index 49d74201..0563d7c4 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
index 51e19752..e37b55dc 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
index 51e19752..e37b55dc 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
index 2e4ce077..233726b4 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
index 2e4ce077..233726b4 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
index 1e3fe2ac..9b874dd0 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
index 1e3fe2ac..9b874dd0 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "libVersion-testing"
+        "version": "5.1.1"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
index c944348c..e585d23d 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
index c944348c..e585d23d 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
+        <version>5.1.1</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
index c7d2bafd..0be6cbd0 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
@@ -57,79 +57,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
index c7d2bafd..0be6cbd0 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
@@ -57,79 +57,7 @@
   "metadata": {
     "tools": [
       {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-bom/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-bom-tool.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python/#readme"
-          }
-        ],
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
+        "externalReferences": [   ],
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
         "version": "libVersion-testing"
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
index f0decf6c..c6b3b32e 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
index f0decf6c..c6b3b32e 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
@@ -37,32 +37,7 @@
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
         <version>libVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-python-lib/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          </reference>
-        </externalReferences>
+        <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
   </metadata>

From 08e02586d39b9cd9701a105967c0cf6e9184d838 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 12 Nov 2023 11:13:48 +0100
Subject: [PATCH 082/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/integration/test_requirements.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 1d26c76a..f97f9dc1 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -32,6 +32,7 @@
 from tests import INFILES_DIRECTORY, SnapshotMixin, make_comparable
 
 infiles = glob(join(INFILES_DIRECTORY, 'requirements', '*'))
+
 unsupported_of_sf = [
     (OutputFormat.JSON, SchemaVersion.V1_1),
     (OutputFormat.JSON, SchemaVersion.V1_0),

From 04f2c49cfaf99ab578752f787c1683a71c738669 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 12 Nov 2023 11:31:17 +0100
Subject: [PATCH 083/155] environment intro

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py         |  4 +-
 cyclonedx_py/_internal/environment.py | 60 +++++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 cyclonedx_py/_internal/environment.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 54cfe222..2e6400cd 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -24,6 +24,7 @@
 from cyclonedx.schema import OutputFormat, SchemaVersion
 
 from .. import __version__
+from .environment import EnvironmentBB
 from .pipenv import PipenvBB
 from .poetry import PoetryBB
 from .requirements import RequirementsBB
@@ -101,9 +102,10 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
 
         scbbc: Type['BomBuilder']
         for sct, scbbc, scd in (  # type:ignore[assignment]
-            ('requirements', RequirementsBB, 'HELP TODO'),
+            ('environment', EnvironmentBB, 'HELP TODO'),
             ('pipenv', PipenvBB, 'HELP TODO'),
             ('poetry', PoetryBB, 'HELP TODO'),
+            ('requirements', RequirementsBB, 'HELP TODO'),
         ):
             spp = scbbc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
new file mode 100644
index 00000000..29d54d57
--- /dev/null
+++ b/cyclonedx_py/_internal/environment.py
@@ -0,0 +1,60 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from typing import TYPE_CHECKING, Any, BinaryIO
+
+from . import BomBuilder
+
+if TYPE_CHECKING:  # pragma: no cover
+    from argparse import ArgumentParser
+    from logging import Logger
+
+    from cyclonedx.model.bom import Bom
+
+
+# !!! be as lazy loading as possible, as greedy as needed
+# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+
+
+class EnvironmentBB(BomBuilder):
+
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
+        from argparse import ArgumentParser
+
+        p = ArgumentParser(description='Build an SBOM based on python environment',
+                           **kwargs)
+        # TODO
+        return p
+
+    def __init__(self, *,
+                 logger: 'Logger',
+                 **kwargs: Any) -> None:
+        self._logger = logger
+
+    def __call__(self, *,  # type:ignore[override]
+                 lock: BinaryIO,
+                 **kwargs: Any) -> 'Bom':
+        from .utils.bom import make_bom
+
+        bom = make_bom()
+
+        # TODO
+        # maybe utilize https://github.com/tox-dev/pipdeptree ?
+
+        return bom

From d444bea2c58e94974e74d230e74a47e0b92242ee Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 12 Nov 2023 11:55:26 +0100
Subject: [PATCH 084/155] cli default error level

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 2e6400cd..c9a4c121 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -206,7 +206,7 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
         return 1
     del arg_parser, argv
 
-    ll = (logging.ERROR, logging.WARNING, logging.INFO, logging.DEBUG)[min(3, args.pop('verbosity'))]
+    ll = (logging.NOTSET, logging.WARNING, logging.INFO, logging.DEBUG)[min(3, args.pop('verbosity'))]
     lh = logging.StreamHandler(sys.stderr)
     lh.setLevel(ll)
     lh.setFormatter(logging.Formatter('%(levelname)-8s | %(name)s > %(message)s'))

From c05bf630de6a916f7e518622e538fe370c1fecb1 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 12 Nov 2023 12:34:15 +0100
Subject: [PATCH 085/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py                |  9 ++++++---
 .../poetry/group-deps/lock11/pyproject.toml     |  2 +-
 .../poetry/group-deps/lock20/pyproject.toml     |  2 +-
 .../{pyproject.toml => pyproject-proto.toml}    |  0
 .../poetry/main-and-dev/lock10/pyproject.toml   |  2 +-
 .../poetry/main-and-dev/lock11/pyproject.toml   |  2 +-
 .../poetry/main-and-dev/lock20/pyproject.toml   |  2 +-
 .../{pyproject.toml => pyproject-proto.toml}    |  0
 .../regression-issue611/lock20/pyproject.toml   | 15 +--------------
 .../regression-issue611/pyproject-proto.toml    | 14 ++++++++++++++
 .../poetry/with-urls/pyproject-proto.toml       | 17 +++++++++++++++++
 11 files changed, 43 insertions(+), 22 deletions(-)
 rename tests/_data/infiles/poetry/group-deps/{pyproject.toml => pyproject-proto.toml} (100%)
 rename tests/_data/infiles/poetry/main-and-dev/{pyproject.toml => pyproject-proto.toml} (100%)
 mode change 100644 => 120000 tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/regression-issue611/pyproject-proto.toml
 create mode 100644 tests/_data/infiles/poetry/with-urls/pyproject-proto.toml

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index a976099f..5d479878 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -169,10 +169,13 @@ def __call__(self, *,  # type:ignore[override]
             else:
                 groups_with = ','.join(groups_with).split(',')
                 groups_without = ','.join(groups_without).split(',')
-                groups = (set(groups_with) | set(
+                # When used together, `--without` takes precedence over `--with`.
+                # see https://python-poetry.org/docs/managing-dependencies/#installing-group-dependencies
+                groups = set(
                     gn for gn, gc in po_cfg.get('group', {}).items()
-                    if not gc.get('optional')
-                )) - set(groups_without)
+                    # all non-optionals and the `with`-whitelisted optionals
+                    if not gc.get('optional') or gn in groups_with
+                ) - set(groups_without)
 
             return self._make_bom(
                 project, toml_loads(lock.read()),
diff --git a/tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml b/tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml
index 1e11d782..060072be 120000
--- a/tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml
+++ b/tests/_data/infiles/poetry/group-deps/lock11/pyproject.toml
@@ -1 +1 @@
-../pyproject.toml
\ No newline at end of file
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml b/tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml
index 1e11d782..060072be 120000
--- a/tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml
+++ b/tests/_data/infiles/poetry/group-deps/lock20/pyproject.toml
@@ -1 +1 @@
-../pyproject.toml
\ No newline at end of file
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/group-deps/pyproject.toml b/tests/_data/infiles/poetry/group-deps/pyproject-proto.toml
similarity index 100%
rename from tests/_data/infiles/poetry/group-deps/pyproject.toml
rename to tests/_data/infiles/poetry/group-deps/pyproject-proto.toml
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml
index 1e11d782..060072be 120000
--- a/tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml
+++ b/tests/_data/infiles/poetry/main-and-dev/lock10/pyproject.toml
@@ -1 +1 @@
-../pyproject.toml
\ No newline at end of file
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml
index 1e11d782..060072be 120000
--- a/tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml
+++ b/tests/_data/infiles/poetry/main-and-dev/lock11/pyproject.toml
@@ -1 +1 @@
-../pyproject.toml
\ No newline at end of file
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml
index 1e11d782..060072be 120000
--- a/tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml
+++ b/tests/_data/infiles/poetry/main-and-dev/lock20/pyproject.toml
@@ -1 +1 @@
-../pyproject.toml
\ No newline at end of file
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/main-and-dev/pyproject.toml b/tests/_data/infiles/poetry/main-and-dev/pyproject-proto.toml
similarity index 100%
rename from tests/_data/infiles/poetry/main-and-dev/pyproject.toml
rename to tests/_data/infiles/poetry/main-and-dev/pyproject-proto.toml
diff --git a/tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml b/tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml
deleted file mode 100644
index f27c4e41..00000000
--- a/tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml
+++ /dev/null
@@ -1,14 +0,0 @@
-[tool.poetry]
-name = "regression-issue611"
-version = "0.1.0"
-description = "regression for issue #611"
-authors = ["Your Name <you@example.com>"]
-readme = "README.md"
-
-[tool.poetry.dependencies]
-python = "^3.11"
-pyhumps = "3.7.1"
-
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml b/tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/regression-issue611/lock20/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/regression-issue611/pyproject-proto.toml b/tests/_data/infiles/poetry/regression-issue611/pyproject-proto.toml
new file mode 100644
index 00000000..f27c4e41
--- /dev/null
+++ b/tests/_data/infiles/poetry/regression-issue611/pyproject-proto.toml
@@ -0,0 +1,14 @@
+[tool.poetry]
+name = "regression-issue611"
+version = "0.1.0"
+description = "regression for issue #611"
+authors = ["Your Name <you@example.com>"]
+readme = "README.md"
+
+[tool.poetry.dependencies]
+python = "^3.11"
+pyhumps = "3.7.1"
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/with-urls/pyproject-proto.toml b/tests/_data/infiles/poetry/with-urls/pyproject-proto.toml
new file mode 100644
index 00000000..44879c30
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-urls/pyproject-proto.toml
@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "with-urls"
+version = "0.1.0"
+description = "packages from direct urls"
+authors = ["Your Name <you@example.com>"]
+
+
+
+
+
+[tool.poetry.dependencies]
+python = "^3.8"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"

From ed30b9fc9a5e7df1886e60d77719e05035304437 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 12 Nov 2023 14:07:27 +0100
Subject: [PATCH 086/155] poetry groups handling

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 47 +++++++++++++++++++++++++-------
 tests/integration/test_poetry.py | 33 +++++++++++++++++++++-
 2 files changed, 69 insertions(+), 11 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 5d479878..53c4353f 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -19,7 +19,7 @@
 import re
 from enum import Enum
 from itertools import chain
-from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, NamedTuple, Optional, Set
+from typing import TYPE_CHECKING, Any, Dict, FrozenSet, Generator, Iterable, List, NamedTuple, Optional, Set
 
 from . import BomBuilder
 
@@ -49,6 +49,18 @@ class _LockEntry(NamedTuple):
     extras: Dict[str, Set[str]]
 
 
+class GroupsNotFoundError(ValueError):
+    def __init__(self, groups: Iterable[str]):
+        self.__groups = frozenset(groups)
+
+    @property
+    def groups(self) -> FrozenSet[str]:
+        return self.__groups
+
+    def __str__(self) -> str:
+        return 'Group(s) not found: ' + ', '.join(sorted(self.__groups))
+
+
 class PoetryBB(BomBuilder):
 
     @staticmethod
@@ -161,21 +173,36 @@ def __call__(self, *,  # type:ignore[override]
 
             # the group-args shall mimic the ones from poetry, which uses comma-separated lists and multi-use
             # values be like: ['foo', 'bar,bazz'] -> ['foo', 'bar', 'bazz']
+            groups_only_s = set(','.join(groups_only).split(','))
+            groups_with_s = set(','.join(groups_with).split(','))
+            groups_without_s = set(','.join(groups_without).split(','))
+            del groups_only, groups_with, groups_without
+            groups_not_found = set(
+                (gn, srcn) for gns, srcn in [
+                    (groups_only_s, 'only'),
+                    (groups_with_s, 'with'),
+                    (groups_without_s, 'without'),
+                ] for gn in gns
+                if gn not in po_cfg['group'].keys())
+            self._logger.debug('groups_not_found: %r', groups_not_found)
+            if len(groups_not_found):
+                error = GroupsNotFoundError(f'{gn!r} (via {srcn})' for gn, srcn in groups_not_found)
+                self._logger.error(error)
+                raise ValueError(f'some poetry groups are undefined') from error
+            del groups_not_found
             if no_dev:
                 groups = {'main', }
-            elif len(groups_only) > 0:
-                groups_only = ','.join(groups_only).split(',')
-                groups = set(groups_only)
+            elif len(groups_only_s) > 0:
+                groups = groups_only_s
             else:
-                groups_with = ','.join(groups_with).split(',')
-                groups_without = ','.join(groups_without).split(',')
                 # When used together, `--without` takes precedence over `--with`.
                 # see https://python-poetry.org/docs/managing-dependencies/#installing-group-dependencies
                 groups = set(
-                    gn for gn, gc in po_cfg.get('group', {}).items()
+                    gn for gn, gc in po_cfg['group'].items()
                     # all non-optionals and the `with`-whitelisted optionals
-                    if not gc.get('optional') or gn in groups_with
-                ) - set(groups_without)
+                    if not gc.get('optional') or gn in groups_with_s
+                ) - groups_without_s
+            del groups_only_s, groups_with_s, groups_without_s
 
             return self._make_bom(
                 project, toml_loads(lock.read()),
@@ -241,7 +268,7 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
         depends_on = []
         for group_name in use_groups:
             self._logger.debug('processing group %r ...', group_name)
-            for dep_name, dep_spec in po_cfg['group'].get(group_name, {}).get('dependencies', {}).items():
+            for dep_name, dep_spec in po_cfg['group'][group_name].get('dependencies', {}).items():
                 self._logger.debug('root-component depends on %s', dep_name)
                 if dep_name == 'python':
                     continue
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index f2c0359c..44abf407 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -16,6 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+import random
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob
 from io import StringIO
@@ -48,7 +49,7 @@
 @ddt
 class TestPoetry(TestCase, SnapshotMixin):
 
-    def test_cli_with_file_not_found(self) -> None:
+    def test_cli_fails_with_dir_not_found(self) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -65,6 +66,36 @@ def test_cli_with_file_not_found(self) -> None:
         self.assertNotEqual(0, res, err)
         self.assertIn("No such file or directory: 'something-that-must-not-exist.testing", err)
 
+    def test_cli_fails_with_groups_not_found(self) -> None:
+        projectdir = random.choice(projectdirs)
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    '--with', 'MNE-with-A',
+                    '--with', 'MNE-with-B,MNE-with-C',
+                    '--without', 'MNE-without-A',
+                    '--without', 'MNE-without-B,MNE-without-C',
+                    '--only', 'MNE-only-A',
+                    '--only', 'MNE-only-B,MNE-only-C',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn('Group(s) not found:'
+                      " 'MNE-only-A' (via only),"
+                      " 'MNE-only-B' (via only),"
+                      " 'MNE-only-C' (via only),"
+                      " 'MNE-with-A' (via with),"
+                      " 'MNE-with-B' (via with),"
+                      " 'MNE-with-C' (via with),"
+                      " 'MNE-without-A' (via without),"
+                      " 'MNE-without-B' (via without),"
+                      " 'MNE-without-C' (via without)", err)
+
     @named_data(*test_data)
     def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:

From df2c3833b76d73320ced4877c1b924185829ef9f Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 12 Nov 2023 14:10:22 +0100
Subject: [PATCH 087/155] poetry groups handling

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 53c4353f..0af1c5d4 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -173,9 +173,9 @@ def __call__(self, *,  # type:ignore[override]
 
             # the group-args shall mimic the ones from poetry, which uses comma-separated lists and multi-use
             # values be like: ['foo', 'bar,bazz'] -> ['foo', 'bar', 'bazz']
-            groups_only_s = set(','.join(groups_only).split(','))
-            groups_with_s = set(','.join(groups_with).split(','))
-            groups_without_s = set(','.join(groups_without).split(','))
+            groups_only_s = set(filter(None, ','.join(groups_only).split(',')))
+            groups_with_s = set(filter(None, ','.join(groups_with).split(',')))
+            groups_without_s = set(filter(None, ','.join(groups_without).split(',')))
             del groups_only, groups_with, groups_without
             groups_not_found = set(
                 (gn, srcn) for gns, srcn in [

From f329fa5f5b9bb5aaa9036dc6eafc63f9161ba794 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 12 Nov 2023 14:31:04 +0100
Subject: [PATCH 088/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 0af1c5d4..72505ce1 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -19,7 +19,7 @@
 import re
 from enum import Enum
 from itertools import chain
-from typing import TYPE_CHECKING, Any, Dict, FrozenSet, Generator, Iterable, List, NamedTuple, Optional, Set
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, NamedTuple, Optional, Set
 
 from . import BomBuilder
 
@@ -50,13 +50,9 @@ class _LockEntry(NamedTuple):
 
 
 class GroupsNotFoundError(ValueError):
-    def __init__(self, groups: Iterable[str]):
+    def __init__(self, groups: Iterable[str]) -> None:
         self.__groups = frozenset(groups)
 
-    @property
-    def groups(self) -> FrozenSet[str]:
-        return self.__groups
-
     def __str__(self) -> str:
         return 'Group(s) not found: ' + ', '.join(sorted(self.__groups))
 
@@ -102,7 +98,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        dest='no_dev',
                        action='store_true')
         eg = p.add_mutually_exclusive_group()
-        eg.add_argument('--extras',
+        eg.add_argument('-E', '--extras',
                         metavar='EXTRAS',
                         help='Extra sets of dependencies to include (multiple values allowed)',
                         action='append',
@@ -170,6 +166,7 @@ def __call__(self, *,  # type:ignore[override]
             po_cfg.setdefault('group', {})
             po_cfg['group'].setdefault('main', {'dependencies': po_cfg.get('dependencies', {})})
             po_cfg['group'].setdefault('dev', {'dependencies': po_cfg.get('dev-dependencies', {})})
+            po_cfg.setdefault('extras', {})
 
             # the group-args shall mimic the ones from poetry, which uses comma-separated lists and multi-use
             # values be like: ['foo', 'bar,bazz'] -> ['foo', 'bar', 'bazz']
@@ -185,10 +182,10 @@ def __call__(self, *,  # type:ignore[override]
                 ] for gn in gns
                 if gn not in po_cfg['group'].keys())
             self._logger.debug('groups_not_found: %r', groups_not_found)
-            if len(groups_not_found):
+            if len(groups_not_found) > 0:
                 error = GroupsNotFoundError(f'{gn!r} (via {srcn})' for gn, srcn in groups_not_found)
                 self._logger.error(error)
-                raise ValueError(f'some poetry groups are undefined') from error
+                raise ValueError('some Poetry groups are unknown') from error
             del groups_not_found
             if no_dev:
                 groups = {'main', }
@@ -204,10 +201,16 @@ def __call__(self, *,  # type:ignore[override]
                 ) - groups_without_s
             del groups_only_s, groups_with_s, groups_without_s
 
+            extras_defined = set(po_cfg['extras'].keys())
+            extras_s = set(filter(None, ','.join(extras).split(',')))
+            extras_not_found = extras_s - extras_defined
+            if len(extras_not_found) > 0:
+                pass  # TODO error handling
+
             return self._make_bom(
                 project, toml_loads(lock.read()),
                 groups,
-                set(po_cfg.get('extras', {}).keys() if all_extras else ','.join(extras).split(',')),
+                extras_defined if all_extras else extras_s,
                 mc_type,
             )
 
@@ -230,8 +233,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         lock_data: Dict[str, _LockEntry] = {le.name: le for le in self._parse_lock(locker)}
 
-        extra_deps = set(chain.from_iterable(
-            eds for en, eds in po_cfg.get('extras', {}).items() if en in use_extras))
+        extra_deps = set(chain.from_iterable(po_cfg['extras'][extra] for extra in use_extras))
 
         _dep_pattern = re.compile(r'^(?P<name>.+?)(?:\[(?P<extras>.*?)\]])?$')
         _added_components = set()  # required to prevent hickups and flips

From dc9181f7ac232819a1f951ffc1abd3563fada9f1 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 00:41:03 +0100
Subject: [PATCH 089/155] tidy

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py       | 7 ++++---
 cyclonedx_py/_internal/requirements.py | 6 ++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 72505ce1..05d45c11 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,9 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-import re
 from enum import Enum
-from itertools import chain
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, NamedTuple, Optional, Set
 
 from . import BomBuilder
@@ -217,6 +215,9 @@ def __call__(self, *,  # type:ignore[override]
     def _make_bom(self, project: 'NameDict', locker: 'NameDict',
                   use_groups: Set[str], use_extras: Set[str],
                   mc_type: 'ComponentType') -> 'Bom':
+        from itertools import chain
+        from re import compile as re_compile
+
         from cyclonedx.model import Property
 
         from .utils.bom import make_bom
@@ -235,7 +236,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         extra_deps = set(chain.from_iterable(po_cfg['extras'][extra] for extra in use_extras))
 
-        _dep_pattern = re.compile(r'^(?P<name>.+?)(?:\[(?P<extras>.*?)\]])?$')
+        _dep_pattern = re_compile(r'^(?P<name>.+?)(?:\[(?P<extras>.*?)\]])?$')
         _added_components = set()  # required to prevent hickups and flips
 
         def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 951b3b2e..f3508e30 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,8 +16,6 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from functools import reduce
-from os import unlink
 from typing import TYPE_CHECKING, Any, Generator, List, Set
 
 from . import BomBuilder
@@ -96,6 +94,8 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  requirements_file: str,
                  **kwargs: Any) -> 'Bom':
+        from os import unlink
+
         from pip_requirements_parser import RequirementsFile
 
         if requirements_file == '-':
@@ -114,6 +114,8 @@ def __call__(self, *,  # type:ignore[override]
         return self._make_bom(rf)
 
     def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
+        from functools import reduce
+
         from .utils.bom import make_bom
 
         bom = make_bom()

From eb095902b34eb49aa9f70ad4081815e66c940834 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 00:45:53 +0100
Subject: [PATCH 090/155] todo

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/environment.py  | 2 +-
 cyclonedx_py/_internal/pipenv.py       | 2 +-
 cyclonedx_py/_internal/poetry.py       | 2 +-
 cyclonedx_py/_internal/requirements.py | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 29d54d57..607279a5 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -28,7 +28,7 @@
 
 
 # !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
 
 
 class EnvironmentBB(BomBuilder):
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 28a97b5c..f66fd7f6 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -28,7 +28,7 @@
 
 
 # !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
 
 
 class PipenvBB(BomBuilder):
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 05d45c11..34acd4a9 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -33,7 +33,7 @@
 
 
 # !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
 
 
 class _CdxProperty(Enum):
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index f3508e30..120784f2 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -31,7 +31,7 @@
 
 
 # !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `time -v` for max resident size and see if this changes when global imports are used
+# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
 
 
 class RequirementsBB(BomBuilder):

From e9fe6ee9b9fc881f16fcefedebd028c27382a542 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 00:58:19 +0100
Subject: [PATCH 091/155] docs

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 120784f2..0729e14f 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -42,7 +42,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from textwrap import dedent
 
         p = ArgumentParser(description=dedent('''\
-                           Build an SBOM from frozen requirements.
+                           Build an SBOM from Pip requirements.
 
                            The options mimic the respective ones from Pip.
                            '''),

From 2f73490c70fb43b9f4a88923c524374fd908d42a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 01:09:11 +0100
Subject: [PATCH 092/155] docs

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py         | 12 ++++++------
 cyclonedx_py/_internal/environment.py |  2 +-
 cyclonedx_py/_internal/pipenv.py      |  2 +-
 cyclonedx_py/_internal/poetry.py      |  2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index c9a4c121..fabd728b 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -101,15 +101,15 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                             action='store_false')
 
         scbbc: Type['BomBuilder']
-        for sct, scbbc, scd in (  # type:ignore[assignment]
-            ('environment', EnvironmentBB, 'HELP TODO'),
-            ('pipenv', PipenvBB, 'HELP TODO'),
-            ('poetry', PoetryBB, 'HELP TODO'),
-            ('requirements', RequirementsBB, 'HELP TODO'),
+        for sct, scbbc in (  # type:ignore[assignment]
+            ('environment', EnvironmentBB),
+            ('pipenv', PipenvBB),
+            ('poetry', PoetryBB),
+            ('requirements', RequirementsBB),
         ):
             spp = scbbc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
-                          help=scd,
+                          help=spp.description.split('\n')[0].strip('. '),
                           description=spp.description,
                           epilog=spp.epilog,
                           parents=[spp, op, sco],
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 607279a5..7027131a 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -37,7 +37,7 @@ class EnvironmentBB(BomBuilder):
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import ArgumentParser
 
-        p = ArgumentParser(description='Build an SBOM based on python environment',
+        p = ArgumentParser(description='Build an SBOM from Python environment',
                            **kwargs)
         # TODO
         return p
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index f66fd7f6..f81cb9c8 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -37,7 +37,7 @@ class PipenvBB(BomBuilder):
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser, FileType
 
-        p = ArgumentParser(description='Build an SBOM based on PipEnv',
+        p = ArgumentParser(description='Build an SBOM from Pipenv',
                            **kwargs)
         p.add_argument('lock',
                        metavar='lock-file',
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 34acd4a9..738a75e6 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -67,7 +67,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from .utils.args import argparse_type4enum
 
         p = ArgumentParser(description=dedent('''\
-                           Build an SBOM based on Poetry project.
+                           Build an SBOM from Poetry project.
 
                            The options mimic the respective ones from Poetry.
                            '''),

From cc313aa71725dc55bed83b26f4b2f46ebf1b0cf4 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 04:00:32 +0100
Subject: [PATCH 093/155] docs

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 docs/conf.py          | 8 ++++----
 docs/requirements.txt | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index 7ee9b640..c338fbfb 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -32,16 +32,16 @@
 extensions = [
     "sphinx.ext.autodoc",
     # "sphinx.ext.viewcode",
-    "autoapi.extension",
+    # "autoapi.extension",
     "sphinx_rtd_theme",
     "m2r2"
 ]
 
 # Document Python Code
-autoapi_type = 'python'
-autoapi_dirs = ['../cyclonedx_py']
+# autoapi_type = 'python'
+# autoapi_dirs = ['../cyclonedx_py']
 # see https://sphinx-autoapi.readthedocs.io/en/latest/reference/config.html#confval-autoapi_options
-autoapi_options = ['show-module-summary', 'members', 'undoc-members', 'inherited-members', 'show-inheritance']
+# autoapi_options = ['show-module-summary', 'members', 'undoc-members', 'inherited-members', 'show-inheritance']
 
 source_suffix = ['.rst', '.md']
 
diff --git a/docs/requirements.txt b/docs/requirements.txt
index dd5f9e17..eafdb491 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,4 +1,4 @@
 m2r2>=0.3.2
 sphinx>=7.2.6,<8
-sphinx-autoapi>=3.0.0,<4
+#sphinx-autoapi>=3.0.0,<4
 sphinx-rtd-theme>=1.3.0,<2

From d2afe494bef7be1abc2a350c60bfd802615a7f4d Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 12:47:20 +0100
Subject: [PATCH 094/155] requirements extra

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py            | 20 ++++++
 cyclonedx_py/_internal/poetry.py              | 23 ++++---
 cyclonedx_py/_internal/requirements.py        |  9 ++-
 .../infiles/requirements/with-extras.txt      |  3 +
 .../with-extras.txt-1.0.xml-file.bin          | 12 ++++
 .../with-extras.txt-1.0.xml-stream.bin        | 12 ++++
 .../with-extras.txt-1.1.xml-file.bin          | 17 +++++
 .../with-extras.txt-1.1.xml-stream.bin        | 17 +++++
 .../with-extras.txt-1.2.json-file.bin         | 42 ++++++++++++
 .../with-extras.txt-1.2.json-stream.bin       | 42 ++++++++++++
 .../with-extras.txt-1.2.xml-file.bin          | 34 ++++++++++
 .../with-extras.txt-1.2.xml-stream.bin        | 34 ++++++++++
 .../with-extras.txt-1.3.json-file.bin         | 52 +++++++++++++++
 .../with-extras.txt-1.3.json-stream.bin       | 52 +++++++++++++++
 .../with-extras.txt-1.3.xml-file.bin          | 38 +++++++++++
 .../with-extras.txt-1.3.xml-stream.bin        | 38 +++++++++++
 .../with-extras.txt-1.4.json-file.bin         | 48 ++++++++++++++
 .../with-extras.txt-1.4.json-stream.bin       | 48 ++++++++++++++
 .../with-extras.txt-1.4.xml-file.bin          | 65 +++++++++++++++++++
 .../with-extras.txt-1.4.xml-stream.bin        | 65 +++++++++++++++++++
 20 files changed, 658 insertions(+), 13 deletions(-)
 create mode 100644 tests/_data/infiles/requirements/with-extras.txt
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.4.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-stream.bin

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 55d1df82..4a09f2a7 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -42,3 +42,23 @@ def __init__(self, *,
     @abstractmethod
     def __call__(self, **kwargs: Any) -> 'Bom':  # pragma: no cover
         ...
+
+
+from enum import Enum
+
+
+class PropertyName(Enum):
+    # region python
+    # TODO: register -- name might not be final, find better one
+    PackageExtra = 'cdx:python:package:extra'
+    # endregion python
+
+    # region poetry
+    # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/poetry.md
+    PoetryPackageGroup = 'cdx:poetry:package:group'
+    # endregion poetry
+
+    # region pipenv
+    # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/pipenv.md
+    PipenvPackageCategory = 'cdx:pipenv:package:category'
+    # endregion pipenv
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 738a75e6..dd17cc0d 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,7 +16,6 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from enum import Enum
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, NamedTuple, Optional, Set
 
 from . import BomBuilder
@@ -36,10 +35,6 @@
 # TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
 
 
-class _CdxProperty(Enum):
-    PackageGroup = 'cdx:poetry:package:group'
-
-
 class _LockEntry(NamedTuple):
     name: str
     component: 'Component'
@@ -221,6 +216,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
         from cyclonedx.model import Property
 
         from .utils.bom import make_bom
+        from . import PropertyName
 
         self._logger.debug('use_groups: %r', use_groups)
         self._logger.debug('use_extras: %r', use_extras)
@@ -230,6 +226,10 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
         po_cfg = project['tool']['poetry']
 
         bom.metadata.component = root_c = self.__component4poetryproj(po_cfg, mc_type)
+        root_c.properties.update(Property(
+            name=PropertyName.PackageExtra.value,
+            value=extra
+        ) for extra in use_extras)
         self._logger.debug('root-component: %r', root_c)
 
         lock_data: Dict[str, _LockEntry] = {le.name: le for le in self._parse_lock(locker)}
@@ -279,7 +279,7 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
                     self._logger.warning('skip unlocked dependency: %s', dep_name)
                     continue
                 lock_data[dep_name].component.properties.add(Property(
-                    name=_CdxProperty.PackageGroup.value,
+                    name=PropertyName.PoetryPackageGroup.value,
                     value=group_name
                 ))
                 dep_spec = dep_spec if isinstance(dep_spec, dict) else {'version': dep_spec}
@@ -367,6 +367,7 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
         from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentScope
         from packageurl import PackageURL
+        from . import PropertyName
 
         return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
@@ -375,12 +376,10 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
             description=package.get('description'),
             scope=ComponentScope.OPTIONAL if package.get('optional') else None,
             external_references=self.__extrefs4lock(package),
-            properties=filter(None, [
-                Property(  # for backwards compatibility: category -> group
-                    name=_CdxProperty.PackageGroup.value,
-                    value=package['category']
-                ) if 'category' in package else None
-            ]),
+            properties=[Property(  # for backwards compatibility: category -> group
+                name=PropertyName.PoetryPackageGroup.value,
+                value=package['category']
+            )] if 'category' in package else [],
             purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
         )
 
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 0729e14f..54431222 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -152,6 +152,8 @@ def _make_component(self, req: 'InstallRequirement',
         from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
+        from cyclonedx.model import Property
+        from . import PropertyName
 
         name = req.name
         version = req.get_pinned_version or None
@@ -202,4 +204,9 @@ def _make_component(self, req: 'InstallRequirement',
             purl=PackageURL(type='pypi', name=req.name, version=version,
                             qualifiers=purl_qualifiers
                             ) if not is_local and name else None,
-            external_references=external_references)
+            external_references=external_references,
+            properties=(Property(
+                name=PropertyName.PackageExtra.value,
+                value=extra
+            ) for extra in req.extras)
+        )
diff --git a/tests/_data/infiles/requirements/with-extras.txt b/tests/_data/infiles/requirements/with-extras.txt
new file mode 100644
index 00000000..92c506eb
--- /dev/null
+++ b/tests/_data/infiles/requirements/with-extras.txt
@@ -0,0 +1,3 @@
+# package with extras
+
+cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-file.bin
new file mode 100644
index 00000000..1f0fb594
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-file.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-stream.bin
new file mode 100644
index 00000000..1f0fb594
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-stream.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-file.bin
new file mode 100644
index 00000000..8bb743d6
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-file.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-stream.bin
new file mode 100644
index 00000000..8bb743d6
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-stream.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
new file mode 100644
index 00000000..e5b29ee8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
@@ -0,0 +1,42 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin
new file mode 100644
index 00000000..e5b29ee8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin
@@ -0,0 +1,42 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
new file mode 100644
index 00000000..e6ddd4d0
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
@@ -0,0 +1,34 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin
new file mode 100644
index 00000000..e6ddd4d0
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin
@@ -0,0 +1,34 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
new file mode 100644
index 00000000..11fa05f8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
@@ -0,0 +1,52 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin
new file mode 100644
index 00000000..11fa05f8
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin
@@ -0,0 +1,52 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
new file mode 100644
index 00000000..1f24d44a
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin
new file mode 100644
index 00000000..1f24d44a
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
new file mode 100644
index 00000000..7114ebcd
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
@@ -0,0 +1,48 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-stream.bin
new file mode 100644
index 00000000..7114ebcd
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-stream.bin
@@ -0,0 +1,48 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
new file mode 100644
index 00000000..d547e445
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
@@ -0,0 +1,65 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-stream.bin
new file mode 100644
index 00000000..d547e445
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-stream.bin
@@ -0,0 +1,65 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>

From b7181e0e16ef36c9801bda24c8b5896763f6d515 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 14:38:36 +0100
Subject: [PATCH 095/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py            |    4 +-
 cyclonedx_py/_internal/poetry.py              |   27 +-
 .../poetry/group-deps/lock11/poetry.lock      |    8 +-
 .../poetry/group-deps/lock20/poetry.lock      |   20 +-
 .../poetry/group-deps/pyproject-proto.toml    |    3 +
 .../poetry/with-extras/lock10/poetry.lock     |  108 +
 .../poetry/with-extras/lock10/pyproject.toml  |    1 +
 .../poetry/with-extras/lock11/poetry.lock     |  520 +++
 .../poetry/with-extras/lock11/pyproject.toml  |    1 +
 .../poetry/with-extras/lock20/poetry.lock     |  609 ++++
 .../poetry/with-extras/lock20/pyproject.toml  |    1 +
 .../poetry/with-extras/pyproject-proto.toml   |   18 +
 .../poetry/group-deps-lock11-1.0.xml.bin      |   11 +-
 .../poetry/group-deps-lock11-1.1.xml.bin      |   12 +-
 .../poetry/group-deps-lock11-1.2.json.bin     |   22 +-
 .../poetry/group-deps-lock11-1.2.xml.bin      |   18 +-
 .../poetry/group-deps-lock11-1.3.json.bin     |   52 +-
 .../poetry/group-deps-lock11-1.3.xml.bin      |   39 +-
 .../poetry/group-deps-lock11-1.4.json.bin     |   52 +-
 .../poetry/group-deps-lock11-1.4.xml.bin      |   39 +-
 .../poetry/group-deps-lock20-1.0.xml.bin      |   11 +-
 .../poetry/group-deps-lock20-1.1.xml.bin      |   24 +-
 .../poetry/group-deps-lock20-1.2.json.bin     |   36 +-
 .../poetry/group-deps-lock20-1.2.xml.bin      |   30 +-
 .../poetry/group-deps-lock20-1.3.json.bin     |  100 +-
 .../poetry/group-deps-lock20-1.3.xml.bin      |   64 +-
 .../poetry/group-deps-lock20-1.4.json.bin     |  100 +-
 .../poetry/group-deps-lock20-1.4.xml.bin      |   64 +-
 .../poetry/main-and-dev-lock10-1.3.json.bin   |   14 +-
 .../poetry/main-and-dev-lock10-1.3.xml.bin    |   14 +-
 .../poetry/main-and-dev-lock10-1.4.json.bin   |   14 +-
 .../poetry/main-and-dev-lock10-1.4.xml.bin    |   14 +-
 .../poetry/main-and-dev-lock11-1.3.json.bin   |   14 +-
 .../poetry/main-and-dev-lock11-1.3.xml.bin    |   14 +-
 .../poetry/main-and-dev-lock11-1.4.json.bin   |   14 +-
 .../poetry/main-and-dev-lock11-1.4.xml.bin    |   14 +-
 .../poetry/main-and-dev-lock20-1.3.json.bin   |    6 +-
 .../poetry/main-and-dev-lock20-1.3.xml.bin    |    6 +-
 .../poetry/main-and-dev-lock20-1.4.json.bin   |    6 +-
 .../poetry/main-and-dev-lock20-1.4.xml.bin    |    6 +-
 .../private-packges-lock10-1.3.json.bin       |    4 +-
 .../poetry/private-packges-lock10-1.3.xml.bin |    4 +-
 .../private-packges-lock10-1.4.json.bin       |    4 +-
 .../poetry/private-packges-lock10-1.4.xml.bin |    4 +-
 .../private-packges-lock11-1.3.json.bin       |   18 +-
 .../poetry/private-packges-lock11-1.3.xml.bin |   18 +-
 .../private-packges-lock11-1.4.json.bin       |   18 +-
 .../poetry/private-packges-lock11-1.4.xml.bin |   18 +-
 .../private-packges-lock20-1.3.json.bin       |    6 +-
 .../poetry/private-packges-lock20-1.3.xml.bin |    6 +-
 .../private-packges-lock20-1.4.json.bin       |    6 +-
 .../poetry/private-packges-lock20-1.4.xml.bin |    6 +-
 .../regression-issue611-lock20-1.3.json.bin   |    2 +-
 .../regression-issue611-lock20-1.3.xml.bin    |    2 +-
 .../regression-issue611-lock20-1.4.json.bin   |    2 +-
 .../regression-issue611-lock20-1.4.xml.bin    |    2 +-
 .../poetry/some-extras-lock10-1.0.xml.bin     |   61 +
 .../poetry/some-extras-lock10-1.1.xml.bin     |   54 +
 .../poetry/some-extras-lock10-1.2.json.bin    |  134 +
 .../poetry/some-extras-lock10-1.2.xml.bin     |   95 +
 .../poetry/some-extras-lock10-1.3.json.bin    |  182 ++
 .../poetry/some-extras-lock10-1.3.xml.bin     |  119 +
 .../poetry/some-extras-lock10-1.4.json.bin    |  178 +
 .../poetry/some-extras-lock10-1.4.xml.bin     |  146 +
 .../poetry/some-extras-lock11-1.0.xml.bin     |  229 ++
 .../poetry/some-extras-lock11-1.1.xml.bin     |  201 ++
 .../poetry/some-extras-lock11-1.2.json.bin    |  428 +++
 .../poetry/some-extras-lock11-1.2.xml.bin     |  297 ++
 .../poetry/some-extras-lock11-1.3.json.bin    |  602 ++++
 .../poetry/some-extras-lock11-1.3.xml.bin     |  384 +++
 .../poetry/some-extras-lock11-1.4.json.bin    |  598 ++++
 .../poetry/some-extras-lock11-1.4.xml.bin     |  411 +++
 .../poetry/some-extras-lock20-1.0.xml.bin     |  221 ++
 .../poetry/some-extras-lock20-1.1.xml.bin     |  971 ++++++
 .../poetry/some-extras-lock20-1.2.json.bin    | 1431 ++++++++
 .../poetry/some-extras-lock20-1.2.xml.bin     | 1064 ++++++
 .../poetry/some-extras-lock20-1.3.json.bin    | 2889 +++++++++++++++++
 .../poetry/some-extras-lock20-1.3.xml.bin     | 1793 ++++++++++
 .../poetry/some-extras-lock20-1.4.json.bin    | 2885 ++++++++++++++++
 .../poetry/some-extras-lock20-1.4.xml.bin     | 1820 +++++++++++
 .../poetry/some-groups-lock11-1.0.xml.bin     |   54 +
 .../poetry/some-groups-lock11-1.1.xml.bin     |   47 +
 .../poetry/some-groups-lock11-1.2.json.bin    |  127 +
 .../poetry/some-groups-lock11-1.2.xml.bin     |   88 +
 .../poetry/some-groups-lock11-1.3.json.bin    |  177 +
 .../poetry/some-groups-lock11-1.3.xml.bin     |  111 +
 .../poetry/some-groups-lock11-1.4.json.bin    |  173 +
 .../poetry/some-groups-lock11-1.4.xml.bin     |  138 +
 .../poetry/some-groups-lock20-1.0.xml.bin     |   54 +
 .../poetry/some-groups-lock20-1.1.xml.bin     |  103 +
 .../poetry/some-groups-lock20-1.2.json.bin    |  197 ++
 .../poetry/some-groups-lock20-1.2.xml.bin     |  144 +
 .../poetry/some-groups-lock20-1.3.json.bin    |  299 ++
 .../poetry/some-groups-lock20-1.3.xml.bin     |  195 ++
 .../poetry/some-groups-lock20-1.4.json.bin    |  295 ++
 .../poetry/some-groups-lock20-1.4.xml.bin     |  222 ++
 .../poetry/with-extras-lock10-1.0.xml.bin     |    4 +
 .../poetry/with-extras-lock10-1.1.xml.bin     |    4 +
 .../poetry/with-extras-lock10-1.2.json.bin    |   33 +
 .../poetry/with-extras-lock10-1.2.xml.bin     |   26 +
 .../poetry/with-extras-lock10-1.3.json.bin    |   33 +
 .../poetry/with-extras-lock10-1.3.xml.bin     |   26 +
 .../poetry/with-extras-lock10-1.4.json.bin    |   29 +
 .../poetry/with-extras-lock10-1.4.xml.bin     |   53 +
 .../poetry/with-extras-lock11-1.0.xml.bin     |    4 +
 .../poetry/with-extras-lock11-1.1.xml.bin     |    4 +
 .../poetry/with-extras-lock11-1.2.json.bin    |   33 +
 .../poetry/with-extras-lock11-1.2.xml.bin     |   26 +
 .../poetry/with-extras-lock11-1.3.json.bin    |   33 +
 .../poetry/with-extras-lock11-1.3.xml.bin     |   26 +
 .../poetry/with-extras-lock11-1.4.json.bin    |   29 +
 .../poetry/with-extras-lock11-1.4.xml.bin     |   53 +
 .../poetry/with-extras-lock20-1.0.xml.bin     |    4 +
 .../poetry/with-extras-lock20-1.1.xml.bin     |    4 +
 .../poetry/with-extras-lock20-1.2.json.bin    |   33 +
 .../poetry/with-extras-lock20-1.2.xml.bin     |   26 +
 .../poetry/with-extras-lock20-1.3.json.bin    |   33 +
 .../poetry/with-extras-lock20-1.3.xml.bin     |   26 +
 .../poetry/with-extras-lock20-1.4.json.bin    |   29 +
 .../poetry/with-extras-lock20-1.4.xml.bin     |   53 +
 tests/integration/test_poetry.py              |   73 +-
 121 files changed, 21869 insertions(+), 695 deletions(-)
 create mode 100644 tests/_data/infiles/poetry/with-extras/lock10/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/with-extras/lock10/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/with-extras/lock11/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/with-extras/lock11/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/with-extras/lock20/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/with-extras/lock20/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/with-extras/pyproject-proto.toml
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.4.xml.bin

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 4a09f2a7..16966edc 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -55,10 +55,10 @@ class PropertyName(Enum):
 
     # region poetry
     # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/poetry.md
-    PoetryPackageGroup = 'cdx:poetry:package:group'
+    PoetryGroup = 'cdx:poetry:group'
     # endregion poetry
 
     # region pipenv
     # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/pipenv.md
-    PipenvPackageCategory = 'cdx:pipenv:package:category'
+    PipenvCategory = 'cdx:pipenv:category'
     # endregion pipenv
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index dd17cc0d..369cffd1 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -50,6 +50,14 @@ def __str__(self) -> str:
         return 'Group(s) not found: ' + ', '.join(sorted(self.__groups))
 
 
+class ExtrasNotFoundError(ValueError):
+    def __init__(self, extras: Iterable[str]) -> None:
+        self.__extras = frozenset(extras)
+
+    def __str__(self) -> str:
+        return f'Extra(s) [{",".join(sorted(self.__extras))}] not specified.'
+
+
 class PoetryBB(BomBuilder):
 
     @staticmethod
@@ -180,6 +188,15 @@ def __call__(self, *,  # type:ignore[override]
                 self._logger.error(error)
                 raise ValueError('some Poetry groups are unknown') from error
             del groups_not_found
+
+            extras_defined = set(po_cfg['extras'].keys())
+            extras_s = set(filter(None, ','.join(extras).split(',')))
+            extras_not_found = extras_s - extras_defined
+            if len(extras_not_found) > 0:
+                error = ExtrasNotFoundError(extras_not_found)
+                self._logger.error(error)
+                raise ValueError('some package extras are unknown') from error
+
             if no_dev:
                 groups = {'main', }
             elif len(groups_only_s) > 0:
@@ -194,12 +211,6 @@ def __call__(self, *,  # type:ignore[override]
                 ) - groups_without_s
             del groups_only_s, groups_with_s, groups_without_s
 
-            extras_defined = set(po_cfg['extras'].keys())
-            extras_s = set(filter(None, ','.join(extras).split(',')))
-            extras_not_found = extras_s - extras_defined
-            if len(extras_not_found) > 0:
-                pass  # TODO error handling
-
             return self._make_bom(
                 project, toml_loads(lock.read()),
                 groups,
@@ -279,7 +290,7 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
                     self._logger.warning('skip unlocked dependency: %s', dep_name)
                     continue
                 lock_data[dep_name].component.properties.add(Property(
-                    name=PropertyName.PoetryPackageGroup.value,
+                    name=PropertyName.PoetryGroup.value,
                     value=group_name
                 ))
                 dep_spec = dep_spec if isinstance(dep_spec, dict) else {'version': dep_spec}
@@ -377,7 +388,7 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
             scope=ComponentScope.OPTIONAL if package.get('optional') else None,
             external_references=self.__extrefs4lock(package),
             properties=[Property(  # for backwards compatibility: category -> group
-                name=PropertyName.PoetryPackageGroup.value,
+                name=PropertyName.PoetryGroup.value,
                 value=package['category']
             )] if 'category' in package else [],
             purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
diff --git a/tests/_data/infiles/poetry/group-deps/lock11/poetry.lock b/tests/_data/infiles/poetry/group-deps/lock11/poetry.lock
index 117b1ea1..bece08e3 100644
--- a/tests/_data/infiles/poetry/group-deps/lock11/poetry.lock
+++ b/tests/_data/infiles/poetry/group-deps/lock11/poetry.lock
@@ -24,7 +24,7 @@ python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7
 
 [[package]]
 name = "ddt"
-version = "1.6.0"
+version = "1.7.0"
 description = "Data-Driven/Decorated Tests"
 category = "dev"
 optional = false
@@ -79,7 +79,7 @@ python-versions = "*"
 [metadata]
 lock-version = "1.1"
 python-versions = "^3.11"
-content-hash = "3a26528623f0983570e42b51408f462ce200095d0d90add47fa74acede4cbb12"
+content-hash = "9856e62626af9542f9f60a7d4cc6596ad5a5cfd475f9a37369735d42c5c7c2dc"
 
 [metadata.files]
 arrow = [
@@ -91,8 +91,8 @@ colorama = [
     {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
 ]
 ddt = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+    {file = "ddt-1.7.0-py2.py3-none-any.whl", hash = "sha256:a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"},
+    {file = "ddt-1.7.0.tar.gz", hash = "sha256:d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"},
 ]
 isoduration = [
     {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
diff --git a/tests/_data/infiles/poetry/group-deps/lock20/poetry.lock b/tests/_data/infiles/poetry/group-deps/lock20/poetry.lock
index 814dba40..775d78a0 100644
--- a/tests/_data/infiles/poetry/group-deps/lock20/poetry.lock
+++ b/tests/_data/infiles/poetry/group-deps/lock20/poetry.lock
@@ -1,10 +1,9 @@
-# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
 
 [[package]]
 name = "arrow"
 version = "1.3.0"
 description = "Better dates & times for Python"
-category = "dev"
 optional = false
 python-versions = ">=3.8"
 files = [
@@ -18,13 +17,12 @@ types-python-dateutil = ">=2.8.10"
 
 [package.extras]
 doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
-test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
+test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
 
 [[package]]
 name = "colorama"
 version = "0.4.6"
 description = "Cross-platform colored terminal text."
-category = "dev"
 optional = false
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
 files = [
@@ -34,21 +32,19 @@ files = [
 
 [[package]]
 name = "ddt"
-version = "1.6.0"
+version = "1.7.0"
 description = "Data-Driven/Decorated Tests"
-category = "dev"
 optional = false
 python-versions = "*"
 files = [
-    {file = "ddt-1.6.0-py2.py3-none-any.whl", hash = "sha256:e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"},
-    {file = "ddt-1.6.0.tar.gz", hash = "sha256:f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"},
+    {file = "ddt-1.7.0-py2.py3-none-any.whl", hash = "sha256:a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"},
+    {file = "ddt-1.7.0.tar.gz", hash = "sha256:d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"},
 ]
 
 [[package]]
 name = "isoduration"
 version = "20.11.0"
 description = "Operations with ISO 8601 durations"
-category = "dev"
 optional = false
 python-versions = ">=3.7"
 files = [
@@ -63,7 +59,6 @@ arrow = ">=0.15.0"
 name = "python-dateutil"
 version = "2.8.2"
 description = "Extensions to the standard Python datetime module"
-category = "dev"
 optional = false
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
 files = [
@@ -78,7 +73,6 @@ six = ">=1.5"
 name = "six"
 version = "1.16.0"
 description = "Python 2 and 3 compatibility utilities"
-category = "dev"
 optional = false
 python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
 files = [
@@ -90,7 +84,6 @@ files = [
 name = "toml"
 version = "0.10.2"
 description = "Python Library for Tom's Obvious, Minimal Language"
-category = "main"
 optional = false
 python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
 files = [
@@ -102,7 +95,6 @@ files = [
 name = "types-python-dateutil"
 version = "2.8.19.14"
 description = "Typing stubs for python-dateutil"
-category = "dev"
 optional = false
 python-versions = "*"
 files = [
@@ -113,4 +105,4 @@ files = [
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.11"
-content-hash = "3a26528623f0983570e42b51408f462ce200095d0d90add47fa74acede4cbb12"
+content-hash = "9856e62626af9542f9f60a7d4cc6596ad5a5cfd475f9a37369735d42c5c7c2dc"
diff --git a/tests/_data/infiles/poetry/group-deps/pyproject-proto.toml b/tests/_data/infiles/poetry/group-deps/pyproject-proto.toml
index 4c3db984..b1611567 100644
--- a/tests/_data/infiles/poetry/group-deps/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/group-deps/pyproject-proto.toml
@@ -18,6 +18,9 @@ ddt = "^1.6.0"
 [tool.poetry.group.groupB.dependencies]
 isoduration = "^20.11.0"
 
+[tool.poetry.group.groupA]
+optional = true
+
 [tool.poetry.group.groupA.dependencies]
 isoduration = "^20.11.0"
 colorama = "^0.4.6"
diff --git a/tests/_data/infiles/poetry/with-extras/lock10/poetry.lock b/tests/_data/infiles/poetry/with-extras/lock10/poetry.lock
new file mode 100644
index 00000000..560d617b
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-extras/lock10/poetry.lock
@@ -0,0 +1,108 @@
+[[package]]
+category = "main"
+description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
+name = "boolean.py"
+optional = true
+python-versions = "*"
+version = "4.0"
+
+[[package]]
+category = "main"
+description = "Python library for CycloneDX"
+name = "cyclonedx-python-lib"
+optional = true
+python-versions = ">=3.8,<4.0"
+version = "5.1.1"
+
+[package.dependencies]
+license-expression = ">=30,<31"
+packageurl-python = ">=0.11"
+py-serializable = ">=0.15,<0.16"
+sortedcontainers = ">=2.4.0,<3.0.0"
+
+[package.dependencies.jsonschema]
+extras = ["format"]
+optional = true
+version = ">=4.18,<5.0"
+
+[package.dependencies.lxml]
+optional = true
+version = ">=4,<5"
+
+[package.extras]
+json-validation = ["jsonschema (>=4.18,<5.0)"]
+validation = ["jsonschema (>=4.18,<5.0)", "lxml (>=4,<5)"]
+xml-validation = ["lxml (>=4,<5)"]
+
+[[package]]
+category = "main"
+description = "XML bomb protection for Python stdlib modules"
+name = "defusedxml"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+version = "0.7.1"
+
+[[package]]
+category = "main"
+description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
+name = "license-expression"
+optional = true
+python-versions = ">=3.7"
+version = "30.1.1"
+
+[package.dependencies]
+"boolean.py" = ">=4.0"
+
+[package.extras]
+docs = ["Sphinx (5.1.0)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)", "doc8 (>=0.8.1)"]
+testing = ["pytest (>=6,<7.0.0 || >7.0.0)", "pytest-xdist (>=2)", "twine", "black", "isort"]
+
+[[package]]
+category = "main"
+description = "A purl aka. Package URL parser and builder"
+name = "packageurl-python"
+optional = true
+python-versions = ">=3.7"
+version = "0.11.2"
+
+[package.extras]
+build = ["wheel"]
+lint = ["isort", "black", "mypy"]
+sqlalchemy = ["sqlalchemy (>=2.0.0)"]
+test = ["pytest"]
+
+[[package]]
+category = "main"
+description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
+name = "py-serializable"
+optional = true
+python-versions = ">=3.7,<4.0"
+version = "0.15.0"
+
+[package.dependencies]
+defusedxml = ">=0.7.1,<0.8.0"
+
+[[package]]
+category = "main"
+description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
+name = "sortedcontainers"
+optional = true
+python-versions = "*"
+version = "2.4.0"
+
+[extras]
+my-extra = ["cyclonedx-python-lib"]
+
+[metadata]
+content-hash = "36326c9123bc7b66b886bf3d024816b5c2eb03533401ecc9399ef8ac539c3d40"
+lock-version = "1.0"
+python-versions = "^3.8"
+
+[metadata.files]
+"boolean.py" = []
+cyclonedx-python-lib = []
+defusedxml = []
+license-expression = []
+packageurl-python = []
+py-serializable = []
+sortedcontainers = []
diff --git a/tests/_data/infiles/poetry/with-extras/lock10/pyproject.toml b/tests/_data/infiles/poetry/with-extras/lock10/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-extras/lock10/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/with-extras/lock11/poetry.lock b/tests/_data/infiles/poetry/with-extras/lock11/poetry.lock
new file mode 100644
index 00000000..525b4053
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-extras/lock11/poetry.lock
@@ -0,0 +1,520 @@
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+category = "main"
+optional = true
+python-versions = ">=3.8"
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (>=1.0.0,<2.0.0)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (>=3.0.0,<4.0.0)"]
+
+[[package]]
+name = "attrs"
+version = "23.1.0"
+description = "Classes Without Boilerplate"
+category = "main"
+optional = true
+python-versions = ">=3.7"
+
+[package.extras]
+cov = ["attrs", "coverage[toml] (>=5.3)"]
+dev = ["attrs", "pre-commit"]
+docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"]
+tests = ["attrs", "zope-interface"]
+tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist"]
+
+[[package]]
+name = "boolean.py"
+version = "4.0"
+description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
+category = "main"
+optional = true
+python-versions = "*"
+
+[[package]]
+name = "cyclonedx-python-lib"
+version = "5.1.1"
+description = "Python library for CycloneDX"
+category = "main"
+optional = true
+python-versions = ">=3.8,<4.0"
+
+[package.dependencies]
+jsonschema = {version = ">=4.18,<5.0", extras = ["format"], optional = true, markers = "extra == \"validation\" or extra == \"json-validation\""}
+license-expression = ">=30,<31"
+lxml = {version = ">=4,<5", optional = true, markers = "extra == \"validation\" or extra == \"xml-validation\""}
+packageurl-python = ">=0.11"
+py-serializable = ">=0.15,<0.16"
+sortedcontainers = ">=2.4.0,<3.0.0"
+
+[package.extras]
+json-validation = ["jsonschema[format] (>=4.18,<5.0)"]
+validation = ["jsonschema[format] (>=4.18,<5.0)", "lxml (>=4,<5)"]
+xml-validation = ["lxml (>=4,<5)"]
+
+[[package]]
+name = "defusedxml"
+version = "0.7.1"
+description = "XML bomb protection for Python stdlib modules"
+category = "main"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+
+[[package]]
+name = "fqdn"
+version = "1.5.1"
+description = "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers"
+category = "main"
+optional = true
+python-versions = ">=2.7, !=3.0, !=3.1, !=3.2, !=3.3, !=3.4, <4"
+
+[[package]]
+name = "idna"
+version = "3.4"
+description = "Internationalized Domain Names in Applications (IDNA)"
+category = "main"
+optional = true
+python-versions = ">=3.5"
+
+[[package]]
+name = "importlib-resources"
+version = "6.1.1"
+description = "Read resources from Python packages"
+category = "main"
+optional = true
+python-versions = ">=3.8"
+
+[package.dependencies]
+zipp = {version = ">=3.1.0", markers = "python_version < \"3.10\""}
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-mypy (>=0.9.1)", "pytest-ruff", "zipp (>=3.17)"]
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+category = "main"
+optional = true
+python-versions = ">=3.7"
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "jsonpointer"
+version = "2.4"
+description = "Identify specific nodes in a JSON document (RFC 6901)"
+category = "main"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*, !=3.6.*"
+
+[[package]]
+name = "jsonschema"
+version = "4.19.2"
+description = "An implementation of JSON Schema validation for Python"
+category = "main"
+optional = true
+python-versions = ">=3.8"
+
+[package.dependencies]
+attrs = ">=22.2.0"
+fqdn = {version = "*", optional = true, markers = "extra == \"format\""}
+idna = {version = "*", optional = true, markers = "extra == \"format\""}
+importlib-resources = {version = ">=1.4.0", markers = "python_version < \"3.9\""}
+isoduration = {version = "*", optional = true, markers = "extra == \"format\""}
+jsonpointer = {version = ">1.13", optional = true, markers = "extra == \"format\""}
+jsonschema-specifications = ">=2023.03.6"
+pkgutil-resolve-name = {version = ">=1.3.10", markers = "python_version < \"3.9\""}
+referencing = ">=0.28.4"
+rfc3339-validator = {version = "*", optional = true, markers = "extra == \"format\""}
+rfc3987 = {version = "*", optional = true, markers = "extra == \"format\""}
+rpds-py = ">=0.7.1"
+uri-template = {version = "*", optional = true, markers = "extra == \"format\""}
+webcolors = {version = ">=1.11", optional = true, markers = "extra == \"format\""}
+
+[package.extras]
+format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
+format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3986-validator (>0.1.0)", "uri-template", "webcolors (>=1.11)"]
+
+[[package]]
+name = "jsonschema-specifications"
+version = "2023.7.1"
+description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
+category = "main"
+optional = true
+python-versions = ">=3.8"
+
+[package.dependencies]
+importlib-resources = {version = ">=1.4.0", markers = "python_version < \"3.9\""}
+referencing = ">=0.28.0"
+
+[[package]]
+name = "license-expression"
+version = "30.1.1"
+description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
+category = "main"
+optional = true
+python-versions = ">=3.7"
+
+[package.dependencies]
+"boolean.py" = ">=4.0"
+
+[package.extras]
+docs = ["Sphinx (==5.1.0)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)"]
+testing = ["black", "isort", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)", "twine"]
+
+[[package]]
+name = "lxml"
+version = "4.9.3"
+description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
+category = "main"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
+
+[package.extras]
+cssselect = ["cssselect (>=0.7)"]
+html5 = ["html5lib"]
+htmlsoup = ["beautifulsoup4"]
+source = ["Cython (>=0.29.35)"]
+
+[[package]]
+name = "packageurl-python"
+version = "0.11.2"
+description = "A purl aka. Package URL parser and builder"
+category = "main"
+optional = true
+python-versions = ">=3.7"
+
+[package.extras]
+build = ["wheel"]
+lint = ["black", "isort", "mypy"]
+sqlalchemy = ["sqlalchemy (>=2.0.0)"]
+test = ["pytest"]
+
+[[package]]
+name = "pkgutil-resolve-name"
+version = "1.3.10"
+description = "Resolve a name to an object."
+category = "main"
+optional = true
+python-versions = ">=3.6"
+
+[[package]]
+name = "py-serializable"
+version = "0.15.0"
+description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
+category = "main"
+optional = true
+python-versions = ">=3.7,<4.0"
+
+[package.dependencies]
+defusedxml = ">=0.7.1,<0.8.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+category = "main"
+optional = true
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "referencing"
+version = "0.30.2"
+description = "JSON Referencing + Python"
+category = "main"
+optional = true
+python-versions = ">=3.8"
+
+[package.dependencies]
+attrs = ">=22.2.0"
+rpds-py = ">=0.7.0"
+
+[[package]]
+name = "rfc3339-validator"
+version = "0.1.4"
+description = "A pure python RFC3339 validator"
+category = "main"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+
+[package.dependencies]
+six = "*"
+
+[[package]]
+name = "rfc3987"
+version = "1.3.8"
+description = "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)"
+category = "main"
+optional = true
+python-versions = "*"
+
+[[package]]
+name = "rpds-py"
+version = "0.12.0"
+description = "Python bindings to Rust's persistent data structures (rpds)"
+category = "main"
+optional = true
+python-versions = ">=3.8"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+category = "main"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+
+[[package]]
+name = "sortedcontainers"
+version = "2.4.0"
+description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
+category = "main"
+optional = true
+python-versions = "*"
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+category = "main"
+optional = true
+python-versions = "*"
+
+[[package]]
+name = "uri-template"
+version = "1.3.0"
+description = "RFC 6570 URI Template Processor"
+category = "main"
+optional = true
+python-versions = ">=3.7"
+
+[package.extras]
+dev = ["flake8", "flake8-annotations", "flake8-bandit", "flake8-bugbear", "flake8-commas", "flake8-comprehensions", "flake8-continuation", "flake8-datetimez", "flake8-docstrings", "flake8-import-order", "flake8-literal", "flake8-modern-annotations", "flake8-noqa", "flake8-pyproject", "flake8-requirements", "flake8-typechecking-import", "flake8-use-fstring", "mypy", "pep8-naming", "types-pyyaml"]
+
+[[package]]
+name = "webcolors"
+version = "1.13"
+description = "A library for working with the color formats defined by HTML and CSS."
+category = "main"
+optional = true
+python-versions = ">=3.7"
+
+[package.extras]
+docs = ["furo", "sphinx", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-notfound-page", "sphinxext-opengraph"]
+tests = ["pytest", "pytest-cov"]
+
+[[package]]
+name = "zipp"
+version = "3.17.0"
+description = "Backport of pathlib-compatible object wrapper for zip files"
+category = "main"
+optional = true
+python-versions = ">=3.8"
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["big-o", "jaraco.functools", "jaraco.itertools", "more-itertools", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-ignore-flaky", "pytest-mypy (>=0.9.1)", "pytest-ruff"]
+
+[extras]
+my-extra = ["cyclonedx-python-lib"]
+
+[metadata]
+lock-version = "1.1"
+python-versions = "^3.8"
+content-hash = "36326c9123bc7b66b886bf3d024816b5c2eb03533401ecc9399ef8ac539c3d40"
+
+[metadata.files]
+arrow = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+attrs = [
+    {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"},
+    {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"},
+]
+"boolean.py" = []
+cyclonedx-python-lib = []
+defusedxml = []
+fqdn = [
+    {file = "fqdn-1.5.1-py3-none-any.whl", hash = "sha256:3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"},
+    {file = "fqdn-1.5.1.tar.gz", hash = "sha256:105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"},
+]
+idna = [
+    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
+    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
+]
+importlib-resources = [
+    {file = "importlib_resources-6.1.1-py3-none-any.whl", hash = "sha256:e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"},
+    {file = "importlib_resources-6.1.1.tar.gz", hash = "sha256:3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"},
+]
+isoduration = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+jsonpointer = [
+    {file = "jsonpointer-2.4-py2.py3-none-any.whl", hash = "sha256:15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"},
+    {file = "jsonpointer-2.4.tar.gz", hash = "sha256:585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"},
+]
+jsonschema = []
+jsonschema-specifications = [
+    {file = "jsonschema_specifications-2023.7.1-py3-none-any.whl", hash = "sha256:05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"},
+    {file = "jsonschema_specifications-2023.7.1.tar.gz", hash = "sha256:c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"},
+]
+license-expression = []
+lxml = []
+packageurl-python = []
+pkgutil-resolve-name = [
+    {file = "pkgutil_resolve_name-1.3.10-py3-none-any.whl", hash = "sha256:ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"},
+    {file = "pkgutil_resolve_name-1.3.10.tar.gz", hash = "sha256:357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"},
+]
+py-serializable = []
+python-dateutil = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+referencing = [
+    {file = "referencing-0.30.2-py3-none-any.whl", hash = "sha256:449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"},
+    {file = "referencing-0.30.2.tar.gz", hash = "sha256:794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"},
+]
+rfc3339-validator = [
+    {file = "rfc3339_validator-0.1.4-py2.py3-none-any.whl", hash = "sha256:24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"},
+    {file = "rfc3339_validator-0.1.4.tar.gz", hash = "sha256:138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"},
+]
+rfc3987 = [
+    {file = "rfc3987-1.3.8-py2.py3-none-any.whl", hash = "sha256:10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"},
+    {file = "rfc3987-1.3.8.tar.gz", hash = "sha256:d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"},
+]
+rpds-py = [
+    {file = "rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl", hash = "sha256:c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"},
+    {file = "rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"},
+    {file = "rpds_py-0.12.0-cp310-none-win32.whl", hash = "sha256:7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"},
+    {file = "rpds_py-0.12.0-cp310-none-win_amd64.whl", hash = "sha256:1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"},
+    {file = "rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl", hash = "sha256:0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"},
+    {file = "rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"},
+    {file = "rpds_py-0.12.0-cp311-none-win32.whl", hash = "sha256:dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"},
+    {file = "rpds_py-0.12.0-cp311-none-win_amd64.whl", hash = "sha256:c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"},
+    {file = "rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl", hash = "sha256:9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"},
+    {file = "rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"},
+    {file = "rpds_py-0.12.0-cp312-none-win32.whl", hash = "sha256:b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"},
+    {file = "rpds_py-0.12.0-cp312-none-win_amd64.whl", hash = "sha256:8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"},
+    {file = "rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl", hash = "sha256:6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"},
+    {file = "rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"},
+    {file = "rpds_py-0.12.0-cp38-none-win32.whl", hash = "sha256:e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"},
+    {file = "rpds_py-0.12.0-cp38-none-win_amd64.whl", hash = "sha256:bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"},
+    {file = "rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl", hash = "sha256:1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"},
+    {file = "rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"},
+    {file = "rpds_py-0.12.0-cp39-none-win32.whl", hash = "sha256:b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"},
+    {file = "rpds_py-0.12.0-cp39-none-win_amd64.whl", hash = "sha256:cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl", hash = "sha256:e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl", hash = "sha256:513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl", hash = "sha256:1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl", hash = "sha256:466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl", hash = "sha256:6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"},
+    {file = "rpds_py-0.12.0.tar.gz", hash = "sha256:7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"},
+]
+six = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+sortedcontainers = []
+types-python-dateutil = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
+uri-template = [
+    {file = "uri-template-1.3.0.tar.gz", hash = "sha256:0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"},
+    {file = "uri_template-1.3.0-py3-none-any.whl", hash = "sha256:a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"},
+]
+webcolors = [
+    {file = "webcolors-1.13-py3-none-any.whl", hash = "sha256:29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"},
+    {file = "webcolors-1.13.tar.gz", hash = "sha256:c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"},
+]
+zipp = [
+    {file = "zipp-3.17.0-py3-none-any.whl", hash = "sha256:0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"},
+    {file = "zipp-3.17.0.tar.gz", hash = "sha256:84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"},
+]
diff --git a/tests/_data/infiles/poetry/with-extras/lock11/pyproject.toml b/tests/_data/infiles/poetry/with-extras/lock11/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-extras/lock11/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/with-extras/lock20/poetry.lock b/tests/_data/infiles/poetry/with-extras/lock20/poetry.lock
new file mode 100644
index 00000000..9e22c9f4
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-extras/lock20/poetry.lock
@@ -0,0 +1,609 @@
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+optional = true
+python-versions = ">=3.8"
+files = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
+
+[[package]]
+name = "attrs"
+version = "23.1.0"
+description = "Classes Without Boilerplate"
+optional = true
+python-versions = ">=3.7"
+files = [
+    {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"},
+    {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"},
+]
+
+[package.extras]
+cov = ["attrs[tests]", "coverage[toml] (>=5.3)"]
+dev = ["attrs[docs,tests]", "pre-commit"]
+docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"]
+tests = ["attrs[tests-no-zope]", "zope-interface"]
+tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
+
+[[package]]
+name = "boolean-py"
+version = "4.0"
+description = "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL."
+optional = true
+python-versions = "*"
+files = [
+    {file = "boolean.py-4.0-py3-none-any.whl", hash = "sha256:2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"},
+    {file = "boolean.py-4.0.tar.gz", hash = "sha256:17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"},
+]
+
+[[package]]
+name = "cyclonedx-python-lib"
+version = "5.1.1"
+description = "Python library for CycloneDX"
+optional = true
+python-versions = ">=3.8,<4.0"
+files = [
+    {file = "cyclonedx_python_lib-5.1.1-py3-none-any.whl", hash = "sha256:2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"},
+    {file = "cyclonedx_python_lib-5.1.1.tar.gz", hash = "sha256:215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"},
+]
+
+[package.dependencies]
+jsonschema = {version = ">=4.18,<5.0", extras = ["format"], optional = true, markers = "extra == \"validation\" or extra == \"json-validation\""}
+license-expression = ">=30,<31"
+lxml = {version = ">=4,<5", optional = true, markers = "extra == \"validation\" or extra == \"xml-validation\""}
+packageurl-python = ">=0.11"
+py-serializable = ">=0.15,<0.16"
+sortedcontainers = ">=2.4.0,<3.0.0"
+
+[package.extras]
+json-validation = ["jsonschema[format] (>=4.18,<5.0)"]
+validation = ["jsonschema[format] (>=4.18,<5.0)", "lxml (>=4,<5)"]
+xml-validation = ["lxml (>=4,<5)"]
+
+[[package]]
+name = "defusedxml"
+version = "0.7.1"
+description = "XML bomb protection for Python stdlib modules"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+files = [
+    {file = "defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"},
+    {file = "defusedxml-0.7.1.tar.gz", hash = "sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"},
+]
+
+[[package]]
+name = "fqdn"
+version = "1.5.1"
+description = "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers"
+optional = true
+python-versions = ">=2.7, !=3.0, !=3.1, !=3.2, !=3.3, !=3.4, <4"
+files = [
+    {file = "fqdn-1.5.1-py3-none-any.whl", hash = "sha256:3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"},
+    {file = "fqdn-1.5.1.tar.gz", hash = "sha256:105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"},
+]
+
+[[package]]
+name = "idna"
+version = "3.4"
+description = "Internationalized Domain Names in Applications (IDNA)"
+optional = true
+python-versions = ">=3.5"
+files = [
+    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
+    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
+]
+
+[[package]]
+name = "importlib-resources"
+version = "6.1.1"
+description = "Read resources from Python packages"
+optional = true
+python-versions = ">=3.8"
+files = [
+    {file = "importlib_resources-6.1.1-py3-none-any.whl", hash = "sha256:e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"},
+    {file = "importlib_resources-6.1.1.tar.gz", hash = "sha256:3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"},
+]
+
+[package.dependencies]
+zipp = {version = ">=3.1.0", markers = "python_version < \"3.10\""}
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-mypy (>=0.9.1)", "pytest-ruff", "zipp (>=3.17)"]
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+optional = true
+python-versions = ">=3.7"
+files = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "jsonpointer"
+version = "2.4"
+description = "Identify specific nodes in a JSON document (RFC 6901)"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*, !=3.6.*"
+files = [
+    {file = "jsonpointer-2.4-py2.py3-none-any.whl", hash = "sha256:15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"},
+    {file = "jsonpointer-2.4.tar.gz", hash = "sha256:585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"},
+]
+
+[[package]]
+name = "jsonschema"
+version = "4.19.2"
+description = "An implementation of JSON Schema validation for Python"
+optional = true
+python-versions = ">=3.8"
+files = [
+    {file = "jsonschema-4.19.2-py3-none-any.whl", hash = "sha256:eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"},
+    {file = "jsonschema-4.19.2.tar.gz", hash = "sha256:c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"},
+]
+
+[package.dependencies]
+attrs = ">=22.2.0"
+fqdn = {version = "*", optional = true, markers = "extra == \"format\""}
+idna = {version = "*", optional = true, markers = "extra == \"format\""}
+importlib-resources = {version = ">=1.4.0", markers = "python_version < \"3.9\""}
+isoduration = {version = "*", optional = true, markers = "extra == \"format\""}
+jsonpointer = {version = ">1.13", optional = true, markers = "extra == \"format\""}
+jsonschema-specifications = ">=2023.03.6"
+pkgutil-resolve-name = {version = ">=1.3.10", markers = "python_version < \"3.9\""}
+referencing = ">=0.28.4"
+rfc3339-validator = {version = "*", optional = true, markers = "extra == \"format\""}
+rfc3987 = {version = "*", optional = true, markers = "extra == \"format\""}
+rpds-py = ">=0.7.1"
+uri-template = {version = "*", optional = true, markers = "extra == \"format\""}
+webcolors = {version = ">=1.11", optional = true, markers = "extra == \"format\""}
+
+[package.extras]
+format = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3987", "uri-template", "webcolors (>=1.11)"]
+format-nongpl = ["fqdn", "idna", "isoduration", "jsonpointer (>1.13)", "rfc3339-validator", "rfc3986-validator (>0.1.0)", "uri-template", "webcolors (>=1.11)"]
+
+[[package]]
+name = "jsonschema-specifications"
+version = "2023.7.1"
+description = "The JSON Schema meta-schemas and vocabularies, exposed as a Registry"
+optional = true
+python-versions = ">=3.8"
+files = [
+    {file = "jsonschema_specifications-2023.7.1-py3-none-any.whl", hash = "sha256:05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"},
+    {file = "jsonschema_specifications-2023.7.1.tar.gz", hash = "sha256:c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"},
+]
+
+[package.dependencies]
+importlib-resources = {version = ">=1.4.0", markers = "python_version < \"3.9\""}
+referencing = ">=0.28.0"
+
+[[package]]
+name = "license-expression"
+version = "30.1.1"
+description = "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic."
+optional = true
+python-versions = ">=3.7"
+files = [
+    {file = "license-expression-30.1.1.tar.gz", hash = "sha256:42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"},
+    {file = "license_expression-30.1.1-py3-none-any.whl", hash = "sha256:8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"},
+]
+
+[package.dependencies]
+"boolean.py" = ">=4.0"
+
+[package.extras]
+docs = ["Sphinx (==5.1.0)", "doc8 (>=0.8.1)", "sphinx-rtd-theme (>=0.5.0)", "sphinxcontrib-apidoc (>=0.3.0)"]
+testing = ["black", "isort", "pytest (>=6,!=7.0.0)", "pytest-xdist (>=2)", "twine"]
+
+[[package]]
+name = "lxml"
+version = "4.9.3"
+description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API."
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, != 3.4.*"
+files = [
+    {file = "lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl", hash = "sha256:b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"},
+    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"},
+    {file = "lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"},
+    {file = "lxml-4.9.3-cp27-cp27m-win32.whl", hash = "sha256:2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"},
+    {file = "lxml-4.9.3-cp27-cp27m-win_amd64.whl", hash = "sha256:4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"},
+    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"},
+    {file = "lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"},
+    {file = "lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"},
+    {file = "lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"},
+    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"},
+    {file = "lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"},
+    {file = "lxml-4.9.3-cp310-cp310-win32.whl", hash = "sha256:cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"},
+    {file = "lxml-4.9.3-cp310-cp310-win_amd64.whl", hash = "sha256:97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"},
+    {file = "lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"},
+    {file = "lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"},
+    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"},
+    {file = "lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"},
+    {file = "lxml-4.9.3-cp311-cp311-win32.whl", hash = "sha256:0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"},
+    {file = "lxml-4.9.3-cp311-cp311-win_amd64.whl", hash = "sha256:25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"},
+    {file = "lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"},
+    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"},
+    {file = "lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"},
+    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"},
+    {file = "lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"},
+    {file = "lxml-4.9.3-cp312-cp312-win_amd64.whl", hash = "sha256:d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"},
+    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"},
+    {file = "lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"},
+    {file = "lxml-4.9.3-cp35-cp35m-win32.whl", hash = "sha256:704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"},
+    {file = "lxml-4.9.3-cp35-cp35m-win_amd64.whl", hash = "sha256:c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"},
+    {file = "lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl", hash = "sha256:64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl", hash = "sha256:4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"},
+    {file = "lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"},
+    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl", hash = "sha256:0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"},
+    {file = "lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl", hash = "sha256:aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"},
+    {file = "lxml-4.9.3-cp36-cp36m-win32.whl", hash = "sha256:50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"},
+    {file = "lxml-4.9.3-cp36-cp36m-win_amd64.whl", hash = "sha256:bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl", hash = "sha256:53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"},
+    {file = "lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"},
+    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"},
+    {file = "lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"},
+    {file = "lxml-4.9.3-cp37-cp37m-win32.whl", hash = "sha256:1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"},
+    {file = "lxml-4.9.3-cp37-cp37m-win_amd64.whl", hash = "sha256:120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl", hash = "sha256:6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"},
+    {file = "lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"},
+    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"},
+    {file = "lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"},
+    {file = "lxml-4.9.3-cp38-cp38-win32.whl", hash = "sha256:57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"},
+    {file = "lxml-4.9.3-cp38-cp38-win_amd64.whl", hash = "sha256:92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"},
+    {file = "lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl", hash = "sha256:9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl", hash = "sha256:303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl", hash = "sha256:5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"},
+    {file = "lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"},
+    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"},
+    {file = "lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"},
+    {file = "lxml-4.9.3-cp39-cp39-win32.whl", hash = "sha256:8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"},
+    {file = "lxml-4.9.3-cp39-cp39-win_amd64.whl", hash = "sha256:4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"},
+    {file = "lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"},
+    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"},
+    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"},
+    {file = "lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl", hash = "sha256:5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"},
+    {file = "lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl", hash = "sha256:ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl", hash = "sha256:8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"},
+    {file = "lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"},
+    {file = "lxml-4.9.3.tar.gz", hash = "sha256:48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"},
+]
+
+[package.extras]
+cssselect = ["cssselect (>=0.7)"]
+html5 = ["html5lib"]
+htmlsoup = ["BeautifulSoup4"]
+source = ["Cython (>=0.29.35)"]
+
+[[package]]
+name = "packageurl-python"
+version = "0.11.2"
+description = "A purl aka. Package URL parser and builder"
+optional = true
+python-versions = ">=3.7"
+files = [
+    {file = "packageurl-python-0.11.2.tar.gz", hash = "sha256:01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"},
+    {file = "packageurl_python-0.11.2-py3-none-any.whl", hash = "sha256:799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"},
+]
+
+[package.extras]
+build = ["wheel"]
+lint = ["black", "isort", "mypy"]
+sqlalchemy = ["sqlalchemy (>=2.0.0)"]
+test = ["pytest"]
+
+[[package]]
+name = "pkgutil-resolve-name"
+version = "1.3.10"
+description = "Resolve a name to an object."
+optional = true
+python-versions = ">=3.6"
+files = [
+    {file = "pkgutil_resolve_name-1.3.10-py3-none-any.whl", hash = "sha256:ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"},
+    {file = "pkgutil_resolve_name-1.3.10.tar.gz", hash = "sha256:357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"},
+]
+
+[[package]]
+name = "py-serializable"
+version = "0.15.0"
+description = "Library for serializing and deserializing Python Objects to and from JSON and XML."
+optional = true
+python-versions = ">=3.7,<4.0"
+files = [
+    {file = "py-serializable-0.15.0.tar.gz", hash = "sha256:8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"},
+    {file = "py_serializable-0.15.0-py3-none-any.whl", hash = "sha256:d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"},
+]
+
+[package.dependencies]
+defusedxml = ">=0.7.1,<0.8.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+optional = true
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+files = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "referencing"
+version = "0.30.2"
+description = "JSON Referencing + Python"
+optional = true
+python-versions = ">=3.8"
+files = [
+    {file = "referencing-0.30.2-py3-none-any.whl", hash = "sha256:449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"},
+    {file = "referencing-0.30.2.tar.gz", hash = "sha256:794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"},
+]
+
+[package.dependencies]
+attrs = ">=22.2.0"
+rpds-py = ">=0.7.0"
+
+[[package]]
+name = "rfc3339-validator"
+version = "0.1.4"
+description = "A pure python RFC3339 validator"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
+files = [
+    {file = "rfc3339_validator-0.1.4-py2.py3-none-any.whl", hash = "sha256:24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"},
+    {file = "rfc3339_validator-0.1.4.tar.gz", hash = "sha256:138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"},
+]
+
+[package.dependencies]
+six = "*"
+
+[[package]]
+name = "rfc3987"
+version = "1.3.8"
+description = "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)"
+optional = true
+python-versions = "*"
+files = [
+    {file = "rfc3987-1.3.8-py2.py3-none-any.whl", hash = "sha256:10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"},
+    {file = "rfc3987-1.3.8.tar.gz", hash = "sha256:d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"},
+]
+
+[[package]]
+name = "rpds-py"
+version = "0.12.0"
+description = "Python bindings to Rust's persistent data structures (rpds)"
+optional = true
+python-versions = ">=3.8"
+files = [
+    {file = "rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl", hash = "sha256:c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"},
+    {file = "rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"},
+    {file = "rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"},
+    {file = "rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"},
+    {file = "rpds_py-0.12.0-cp310-none-win32.whl", hash = "sha256:7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"},
+    {file = "rpds_py-0.12.0-cp310-none-win_amd64.whl", hash = "sha256:1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"},
+    {file = "rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl", hash = "sha256:0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"},
+    {file = "rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"},
+    {file = "rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"},
+    {file = "rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"},
+    {file = "rpds_py-0.12.0-cp311-none-win32.whl", hash = "sha256:dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"},
+    {file = "rpds_py-0.12.0-cp311-none-win_amd64.whl", hash = "sha256:c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"},
+    {file = "rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl", hash = "sha256:9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"},
+    {file = "rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"},
+    {file = "rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"},
+    {file = "rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"},
+    {file = "rpds_py-0.12.0-cp312-none-win32.whl", hash = "sha256:b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"},
+    {file = "rpds_py-0.12.0-cp312-none-win_amd64.whl", hash = "sha256:8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"},
+    {file = "rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl", hash = "sha256:6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"},
+    {file = "rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"},
+    {file = "rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"},
+    {file = "rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"},
+    {file = "rpds_py-0.12.0-cp38-none-win32.whl", hash = "sha256:e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"},
+    {file = "rpds_py-0.12.0-cp38-none-win_amd64.whl", hash = "sha256:bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"},
+    {file = "rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl", hash = "sha256:1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"},
+    {file = "rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"},
+    {file = "rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"},
+    {file = "rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"},
+    {file = "rpds_py-0.12.0-cp39-none-win32.whl", hash = "sha256:b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"},
+    {file = "rpds_py-0.12.0-cp39-none-win_amd64.whl", hash = "sha256:cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl", hash = "sha256:e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"},
+    {file = "rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl", hash = "sha256:0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl", hash = "sha256:513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl", hash = "sha256:1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"},
+    {file = "rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl", hash = "sha256:466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl", hash = "sha256:6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"},
+    {file = "rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"},
+    {file = "rpds_py-0.12.0.tar.gz", hash = "sha256:7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"},
+]
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+optional = true
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+
+[[package]]
+name = "sortedcontainers"
+version = "2.4.0"
+description = "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set"
+optional = true
+python-versions = "*"
+files = [
+    {file = "sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"},
+    {file = "sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"},
+]
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+optional = true
+python-versions = "*"
+files = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
+
+[[package]]
+name = "uri-template"
+version = "1.3.0"
+description = "RFC 6570 URI Template Processor"
+optional = true
+python-versions = ">=3.7"
+files = [
+    {file = "uri-template-1.3.0.tar.gz", hash = "sha256:0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"},
+    {file = "uri_template-1.3.0-py3-none-any.whl", hash = "sha256:a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"},
+]
+
+[package.extras]
+dev = ["flake8", "flake8-annotations", "flake8-bandit", "flake8-bugbear", "flake8-commas", "flake8-comprehensions", "flake8-continuation", "flake8-datetimez", "flake8-docstrings", "flake8-import-order", "flake8-literal", "flake8-modern-annotations", "flake8-noqa", "flake8-pyproject", "flake8-requirements", "flake8-typechecking-import", "flake8-use-fstring", "mypy", "pep8-naming", "types-PyYAML"]
+
+[[package]]
+name = "webcolors"
+version = "1.13"
+description = "A library for working with the color formats defined by HTML and CSS."
+optional = true
+python-versions = ">=3.7"
+files = [
+    {file = "webcolors-1.13-py3-none-any.whl", hash = "sha256:29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"},
+    {file = "webcolors-1.13.tar.gz", hash = "sha256:c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"},
+]
+
+[package.extras]
+docs = ["furo", "sphinx", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-notfound-page", "sphinxext-opengraph"]
+tests = ["pytest", "pytest-cov"]
+
+[[package]]
+name = "zipp"
+version = "3.17.0"
+description = "Backport of pathlib-compatible object wrapper for zip files"
+optional = true
+python-versions = ">=3.8"
+files = [
+    {file = "zipp-3.17.0-py3-none-any.whl", hash = "sha256:0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"},
+    {file = "zipp-3.17.0.tar.gz", hash = "sha256:84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"},
+]
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (<7.2.5)", "sphinx (>=3.5)", "sphinx-lint"]
+testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=2.2)", "pytest-ignore-flaky", "pytest-mypy (>=0.9.1)", "pytest-ruff"]
+
+[extras]
+my-extra = ["cyclonedx-python-lib"]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.8"
+content-hash = "36326c9123bc7b66b886bf3d024816b5c2eb03533401ecc9399ef8ac539c3d40"
diff --git a/tests/_data/infiles/poetry/with-extras/lock20/pyproject.toml b/tests/_data/infiles/poetry/with-extras/lock20/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-extras/lock20/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/with-extras/pyproject-proto.toml b/tests/_data/infiles/poetry/with-extras/pyproject-proto.toml
new file mode 100644
index 00000000..a35ec674
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-extras/pyproject-proto.toml
@@ -0,0 +1,18 @@
+[tool.poetry]
+name = "with-extras"
+version = "0.1.0"
+description = "depenndencies with extras"
+authors = ["Your Name <you@example.com>"]
+
+
+[tool.poetry.dependencies]
+python  = "^3.8"
+cyclonedx-python-lib = {version = "5.1.1", extras = ["json-validation", "xml-validation"], optional = true}
+
+[tool.poetry.extras]
+my-extra = ["cyclonedx-python-lib"]
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin
index 507a3485..23e848da 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin
@@ -8,18 +8,11 @@
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <modified>false</modified>
     </component>
-    <component type="library">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <modified>false</modified>
-    </component>
     <component type="library">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <modified>false</modified>
     </component>
     <component type="library">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
index e7aea997..f33195a4 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
@@ -7,17 +7,11 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
index 20e853fa..9278c3db 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
@@ -9,20 +9,12 @@
       "version": "1.3.0"
     },
     {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
+      "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
       "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
+      "purl": "pkg:pypi/ddt@1.7.0",
       "type": "library",
-      "version": "1.6.0"
+      "version": "1.7.0"
     },
     {
       "bom-ref": "isoduration@20.11.0",
@@ -74,15 +66,11 @@
       "ref": "arrow@1.3.0"
     },
     {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
+      "ref": "ddt@1.7.0"
     },
     {
       "dependsOn": [
-        "colorama@0.4.6",
-        "ddt@1.6.0",
+        "ddt@1.7.0",
         "isoduration@20.11.0",
         "toml@0.10.2"
       ],
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
index 1723151f..7c642cc1 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
@@ -27,17 +27,11 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
@@ -75,11 +69,9 @@
       <dependency ref="python-dateutil@2.8.2"/>
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="ddt@1.7.0"/>
     <dependency ref="group-deps">
-      <dependency ref="colorama@0.4.6"/>
-      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="ddt@1.7.0"/>
       <dependency ref="isoduration@20.11.0"/>
       <dependency ref="toml@0.10.2"/>
     </dependency>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
index d50eee2d..204fc98a 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
@@ -6,7 +6,7 @@
       "name": "arrow",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -15,36 +15,18 @@
       "version": "1.3.0"
     },
     {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "name": "colorama",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        },
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        }
-      ],
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
+      "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
       "name": "ddt",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
-      "purl": "pkg:pypi/ddt@1.6.0",
+      "purl": "pkg:pypi/ddt@1.7.0",
       "type": "library",
-      "version": "1.6.0"
+      "version": "1.7.0"
     },
     {
       "bom-ref": "isoduration@20.11.0",
@@ -52,15 +34,11 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         },
         {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        },
-        {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "groupB"
         }
       ],
@@ -74,7 +52,7 @@
       "name": "python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -88,7 +66,7 @@
       "name": "six",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -102,7 +80,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -116,7 +94,7 @@
       "name": "types-python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -134,15 +112,11 @@
       "ref": "arrow@1.3.0"
     },
     {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
+      "ref": "ddt@1.7.0"
     },
     {
       "dependsOn": [
-        "colorama@0.4.6",
-        "ddt@1.6.0",
+        "ddt@1.7.0",
         "isoduration@20.11.0",
         "toml@0.10.2"
       ],
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
index 11c256c2..1ed74891 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
@@ -27,26 +27,16 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -55,9 +45,8 @@
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-        <property name="cdx:poetry:package:group">groupB</property>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupB</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -66,7 +55,7 @@
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
@@ -75,7 +64,7 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -84,7 +73,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -93,7 +82,7 @@
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
   </components>
@@ -102,11 +91,9 @@
       <dependency ref="python-dateutil@2.8.2"/>
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="ddt@1.7.0"/>
     <dependency ref="group-deps">
-      <dependency ref="colorama@0.4.6"/>
-      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="ddt@1.7.0"/>
       <dependency ref="isoduration@20.11.0"/>
       <dependency ref="toml@0.10.2"/>
     </dependency>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
index 30b781b6..9835d156 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
@@ -6,7 +6,7 @@
       "name": "arrow",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -15,36 +15,18 @@
       "version": "1.3.0"
     },
     {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "name": "colorama",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        },
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        }
-      ],
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
+      "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
       "name": "ddt",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
-      "purl": "pkg:pypi/ddt@1.6.0",
+      "purl": "pkg:pypi/ddt@1.7.0",
       "type": "library",
-      "version": "1.6.0"
+      "version": "1.7.0"
     },
     {
       "bom-ref": "isoduration@20.11.0",
@@ -52,15 +34,11 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         },
         {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        },
-        {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "groupB"
         }
       ],
@@ -74,7 +52,7 @@
       "name": "python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -88,7 +66,7 @@
       "name": "six",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -102,7 +80,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -116,7 +94,7 @@
       "name": "types-python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -134,15 +112,11 @@
       "ref": "arrow@1.3.0"
     },
     {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
+      "ref": "ddt@1.7.0"
     },
     {
       "dependsOn": [
-        "colorama@0.4.6",
-        "ddt@1.6.0",
+        "ddt@1.7.0",
         "isoduration@20.11.0",
         "toml@0.10.2"
       ],
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
index 62e4f877..c3f60318 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
@@ -54,26 +54,16 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -82,9 +72,8 @@
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-        <property name="cdx:poetry:package:group">groupB</property>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupB</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -93,7 +82,7 @@
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
@@ -102,7 +91,7 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -111,7 +100,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -120,7 +109,7 @@
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
   </components>
@@ -129,11 +118,9 @@
       <dependency ref="python-dateutil@2.8.2"/>
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="ddt@1.7.0"/>
     <dependency ref="group-deps">
-      <dependency ref="colorama@0.4.6"/>
-      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="ddt@1.7.0"/>
       <dependency ref="isoduration@20.11.0"/>
       <dependency ref="toml@0.10.2"/>
     </dependency>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin
index 507a3485..23e848da 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin
@@ -8,18 +8,11 @@
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <modified>false</modified>
     </component>
-    <component type="library">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <modified>false</modified>
-    </component>
     <component type="library">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <modified>false</modified>
     </component>
     <component type="library">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
index 14e0000c..2f80e75e 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
@@ -15,31 +15,17 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
         </reference>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
index fce62210..3ffad094 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
@@ -19,40 +19,22 @@
       "version": "1.3.0"
     },
     {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
-        },
-        {
-          "type": "distribution",
-          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
-        }
-      ],
-      "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
+      "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl"
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
         },
         {
           "type": "distribution",
-          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz"
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
         }
       ],
       "name": "ddt",
-      "purl": "pkg:pypi/ddt@1.6.0",
+      "purl": "pkg:pypi/ddt@1.7.0",
       "type": "library",
-      "version": "1.6.0"
+      "version": "1.7.0"
     },
     {
       "bom-ref": "isoduration@20.11.0",
@@ -154,15 +136,11 @@
       "ref": "arrow@1.3.0"
     },
     {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
+      "ref": "ddt@1.7.0"
     },
     {
       "dependsOn": [
-        "colorama@0.4.6",
-        "ddt@1.6.0",
+        "ddt@1.7.0",
         "isoduration@20.11.0",
         "toml@0.10.2"
       ],
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
index 720e6702..3aa1604d 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
@@ -35,31 +35,17 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
         </reference>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
         </reference>
       </externalReferences>
     </component>
@@ -139,11 +125,9 @@
       <dependency ref="python-dateutil@2.8.2"/>
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="ddt@1.7.0"/>
     <dependency ref="group-deps">
-      <dependency ref="colorama@0.4.6"/>
-      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="ddt@1.7.0"/>
       <dependency ref="isoduration@20.11.0"/>
       <dependency ref="toml@0.10.2"/>
     </dependency>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
index 830c0f98..d266ffc7 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
@@ -26,91 +26,45 @@
         }
       ],
       "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/arrow@1.3.0",
       "type": "library",
       "version": "1.3.0"
     },
     {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "externalReferences": [
-        {
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
-        },
-        {
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
-        }
-      ],
-      "name": "colorama",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        },
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        }
-      ],
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
+      "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
       "externalReferences": [
         {
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl"
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
         },
         {
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz"
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
         }
       ],
       "name": "ddt",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
-      "purl": "pkg:pypi/ddt@1.6.0",
+      "purl": "pkg:pypi/ddt@1.7.0",
       "type": "library",
-      "version": "1.6.0"
+      "version": "1.7.0"
     },
     {
       "bom-ref": "isoduration@20.11.0",
@@ -140,15 +94,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        },
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        },
-        {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "groupB"
         }
       ],
@@ -182,12 +128,6 @@
         }
       ],
       "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/python-dateutil@2.8.2",
       "type": "library",
       "version": "2.8.2"
@@ -218,12 +158,6 @@
         }
       ],
       "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/six@1.16.0",
       "type": "library",
       "version": "1.16.0"
@@ -256,7 +190,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -290,12 +224,6 @@
         }
       ],
       "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
       "type": "library",
       "version": "2.8.19.14"
@@ -310,15 +238,11 @@
       "ref": "arrow@1.3.0"
     },
     {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
+      "ref": "ddt@1.7.0"
     },
     {
       "dependsOn": [
-        "colorama@0.4.6",
-        "ddt@1.6.0",
+        "ddt@1.7.0",
         "isoduration@20.11.0",
         "toml@0.10.2"
       ],
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
index 131e9f9e..341cfafb 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
@@ -40,55 +40,28 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
-          <hashes>
-            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
-          <hashes>
-            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
           <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
           </hashes>
         </reference>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
           <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
           </hashes>
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -111,9 +84,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-        <property name="cdx:poetry:package:group">groupB</property>
+        <property name="cdx:poetry:group">groupB</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -135,9 +106,6 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
@@ -158,9 +126,6 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
@@ -182,7 +147,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -204,9 +169,6 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
   </components>
   <dependencies>
@@ -214,11 +176,9 @@
       <dependency ref="python-dateutil@2.8.2"/>
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="ddt@1.7.0"/>
     <dependency ref="group-deps">
-      <dependency ref="colorama@0.4.6"/>
-      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="ddt@1.7.0"/>
       <dependency ref="isoduration@20.11.0"/>
       <dependency ref="toml@0.10.2"/>
     </dependency>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
index bbc1bf14..11f924ad 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
@@ -26,91 +26,45 @@
         }
       ],
       "name": "arrow",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/arrow@1.3.0",
       "type": "library",
       "version": "1.3.0"
     },
     {
-      "bom-ref": "colorama@0.4.6",
-      "description": "Cross-platform colored terminal text.",
-      "externalReferences": [
-        {
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
-        },
-        {
-          "hashes": [
-            {
-              "alg": "SHA-256",
-              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
-            }
-          ],
-          "type": "distribution",
-          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
-        }
-      ],
-      "name": "colorama",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        },
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        }
-      ],
-      "purl": "pkg:pypi/colorama@0.4.6",
-      "type": "library",
-      "version": "0.4.6"
-    },
-    {
-      "bom-ref": "ddt@1.6.0",
+      "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
       "externalReferences": [
         {
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d"
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl"
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
         },
         {
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd"
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
             }
           ],
           "type": "distribution",
-          "url": "https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz"
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
         }
       ],
       "name": "ddt",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
-      "purl": "pkg:pypi/ddt@1.6.0",
+      "purl": "pkg:pypi/ddt@1.7.0",
       "type": "library",
-      "version": "1.6.0"
+      "version": "1.7.0"
     },
     {
       "bom-ref": "isoduration@20.11.0",
@@ -140,15 +94,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        },
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "groupA"
-        },
-        {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "groupB"
         }
       ],
@@ -182,12 +128,6 @@
         }
       ],
       "name": "python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/python-dateutil@2.8.2",
       "type": "library",
       "version": "2.8.2"
@@ -218,12 +158,6 @@
         }
       ],
       "name": "six",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/six@1.16.0",
       "type": "library",
       "version": "1.16.0"
@@ -256,7 +190,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -290,12 +224,6 @@
         }
       ],
       "name": "types-python-dateutil",
-      "properties": [
-        {
-          "name": "cdx:poetry:package:group",
-          "value": "dev"
-        }
-      ],
       "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
       "type": "library",
       "version": "2.8.19.14"
@@ -310,15 +238,11 @@
       "ref": "arrow@1.3.0"
     },
     {
-      "ref": "colorama@0.4.6"
-    },
-    {
-      "ref": "ddt@1.6.0"
+      "ref": "ddt@1.7.0"
     },
     {
       "dependsOn": [
-        "colorama@0.4.6",
-        "ddt@1.6.0",
+        "ddt@1.7.0",
         "isoduration@20.11.0",
         "toml@0.10.2"
       ],
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
index b70a8a19..428b82db 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
@@ -67,55 +67,28 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
-    <component type="library" bom-ref="colorama@0.4.6">
-      <name>colorama</name>
-      <version>0.4.6</version>
-      <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
-          <hashes>
-            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
-          </hashes>
-        </reference>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
-          <hashes>
-            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
-          </hashes>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-      </properties>
-    </component>
-    <component type="library" bom-ref="ddt@1.6.0">
+    <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
-      <version>1.6.0</version>
+      <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
-      <purl>pkg:pypi/ddt@1.6.0</purl>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
       <externalReferences>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0-py2.py3-none-any.whl</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
           <hashes>
-            <hash alg="SHA-256">e3c93b961a108b4f4d5a6c7f2263513d928baf3bb5b32af8e1c804bfb041141d</hash>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
           </hashes>
         </reference>
         <reference type="distribution">
-          <url>https://pypi.org/simple/ddt/#ddt-1.6.0.tar.gz</url>
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
           <hashes>
-            <hash alg="SHA-256">f71b348731b8c78c3100bffbd951a769fbd439088d1fdbb3841eee019af80acd</hash>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
           </hashes>
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -138,9 +111,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-        <property name="cdx:poetry:package:group">groupA</property>
-        <property name="cdx:poetry:package:group">groupB</property>
+        <property name="cdx:poetry:group">groupB</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -162,9 +133,6 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
@@ -185,9 +153,6 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
@@ -209,7 +174,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -231,9 +196,6 @@
           </hashes>
         </reference>
       </externalReferences>
-      <properties>
-        <property name="cdx:poetry:package:group">dev</property>
-      </properties>
     </component>
   </components>
   <dependencies>
@@ -241,11 +203,9 @@
       <dependency ref="python-dateutil@2.8.2"/>
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
-    <dependency ref="colorama@0.4.6"/>
-    <dependency ref="ddt@1.6.0"/>
+    <dependency ref="ddt@1.7.0"/>
     <dependency ref="group-deps">
-      <dependency ref="colorama@0.4.6"/>
-      <dependency ref="ddt@1.6.0"/>
+      <dependency ref="ddt@1.7.0"/>
       <dependency ref="isoduration@20.11.0"/>
       <dependency ref="toml@0.10.2"/>
     </dependency>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
index c52e8a5b..77c0ce55 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
@@ -6,7 +6,7 @@
       "name": "arrow",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -34,7 +34,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -48,7 +48,7 @@
       "name": "python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -62,7 +62,7 @@
       "name": "six",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -76,7 +76,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -90,7 +90,7 @@
       "name": "types-python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
index afa8c4f9..df4f2a02 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
@@ -27,7 +27,7 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
@@ -36,7 +36,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -45,7 +45,7 @@
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -54,7 +54,7 @@
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
@@ -63,7 +63,7 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -72,7 +72,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -81,7 +81,7 @@
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
index 00bec73c..2c06f303 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
@@ -6,7 +6,7 @@
       "name": "arrow",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -34,7 +34,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -48,7 +48,7 @@
       "name": "python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -62,7 +62,7 @@
       "name": "six",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -76,7 +76,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -90,7 +90,7 @@
       "name": "types-python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
index 5e739737..68ae7254 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
@@ -54,7 +54,7 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
@@ -63,7 +63,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -72,7 +72,7 @@
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -81,7 +81,7 @@
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
@@ -90,7 +90,7 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -99,7 +99,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -108,7 +108,7 @@
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
index c52e8a5b..77c0ce55 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
@@ -6,7 +6,7 @@
       "name": "arrow",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -34,7 +34,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -48,7 +48,7 @@
       "name": "python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -62,7 +62,7 @@
       "name": "six",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -76,7 +76,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -90,7 +90,7 @@
       "name": "types-python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
index afa8c4f9..df4f2a02 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
@@ -27,7 +27,7 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
@@ -36,7 +36,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -45,7 +45,7 @@
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -54,7 +54,7 @@
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
@@ -63,7 +63,7 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -72,7 +72,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -81,7 +81,7 @@
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
index 00bec73c..2c06f303 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
@@ -6,7 +6,7 @@
       "name": "arrow",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -34,7 +34,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -48,7 +48,7 @@
       "name": "python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -62,7 +62,7 @@
       "name": "six",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -76,7 +76,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -90,7 +90,7 @@
       "name": "types-python-dateutil",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
index 5e739737..68ae7254 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
@@ -54,7 +54,7 @@
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
@@ -63,7 +63,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -72,7 +72,7 @@
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -81,7 +81,7 @@
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="six@1.16.0">
@@ -90,7 +90,7 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -99,7 +99,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
@@ -108,7 +108,7 @@
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
index ca70f87c..3cc6bb1f 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
@@ -58,7 +58,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -94,7 +94,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -190,7 +190,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
index 19e6e859..651e12c1 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
@@ -61,7 +61,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -84,7 +84,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -147,7 +147,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
index 6fe26a51..c9334ec2 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
@@ -58,7 +58,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -94,7 +94,7 @@
       "name": "isoduration",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "dev"
         }
       ],
@@ -190,7 +190,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
index 2a29fa22..ecb754ed 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
@@ -88,7 +88,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
@@ -111,7 +111,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">dev</property>
+        <property name="cdx:poetry:group">dev</property>
       </properties>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
@@ -174,7 +174,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
index 9996f9b5..abeb3327 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
@@ -6,7 +6,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
index 648859e4..4cf2d91e 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
@@ -27,7 +27,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -36,7 +36,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
index 8449718c..1b271bcb 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
@@ -6,7 +6,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
index 2e7f8ea1..1e207d0c 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
@@ -54,7 +54,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -63,7 +63,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
index 06a9f094..620ca9d3 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
@@ -6,7 +6,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "importlib-metadata",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -34,7 +34,7 @@
       "name": "jax",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -48,7 +48,7 @@
       "name": "ml-dtypes",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -62,7 +62,7 @@
       "name": "numpy",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -76,7 +76,7 @@
       "name": "opt-einsum",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -90,7 +90,7 @@
       "name": "scipy",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -104,7 +104,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -118,7 +118,7 @@
       "name": "zipp",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
index 647ec6e1..595fc2f9 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
@@ -27,7 +27,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="importlib-metadata@6.8.0">
@@ -36,7 +36,7 @@
       <description>Read metadata from Python packages</description>
       <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="jax@0.4.20">
@@ -45,7 +45,7 @@
       <description>Differentiate, compile, and transform Numpy code.</description>
       <purl>pkg:pypi/jax@0.4.20</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="ml-dtypes@0.3.1">
@@ -54,7 +54,7 @@
       <description/>
       <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="numpy@1.26.1">
@@ -63,7 +63,7 @@
       <description>Fundamental package for array computing in Python</description>
       <purl>pkg:pypi/numpy@1.26.1</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="opt-einsum@3.3.0">
@@ -72,7 +72,7 @@
       <description>Optimizing numpys einsum function</description>
       <purl>pkg:pypi/opt-einsum@3.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="scipy@1.11.3">
@@ -81,7 +81,7 @@
       <description>Fundamental algorithms for scientific computing in Python</description>
       <purl>pkg:pypi/scipy@1.11.3</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -90,7 +90,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
@@ -99,7 +99,7 @@
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <purl>pkg:pypi/zipp@3.17.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
index 6db9ce27..062ea86c 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
@@ -6,7 +6,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -20,7 +20,7 @@
       "name": "importlib-metadata",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -34,7 +34,7 @@
       "name": "jax",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -48,7 +48,7 @@
       "name": "ml-dtypes",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -62,7 +62,7 @@
       "name": "numpy",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -76,7 +76,7 @@
       "name": "opt-einsum",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -90,7 +90,7 @@
       "name": "scipy",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -104,7 +104,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -118,7 +118,7 @@
       "name": "zipp",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
index db7d9c2d..ec802166 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
@@ -54,7 +54,7 @@
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="importlib-metadata@6.8.0">
@@ -63,7 +63,7 @@
       <description>Read metadata from Python packages</description>
       <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="jax@0.4.20">
@@ -72,7 +72,7 @@
       <description>Differentiate, compile, and transform Numpy code.</description>
       <purl>pkg:pypi/jax@0.4.20</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="ml-dtypes@0.3.1">
@@ -81,7 +81,7 @@
       <description/>
       <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="numpy@1.26.1">
@@ -90,7 +90,7 @@
       <description>Fundamental package for array computing in Python</description>
       <purl>pkg:pypi/numpy@1.26.1</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="opt-einsum@3.3.0">
@@ -99,7 +99,7 @@
       <description>Optimizing numpys einsum function</description>
       <purl>pkg:pypi/opt-einsum@3.3.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="scipy@1.11.3">
@@ -108,7 +108,7 @@
       <description>Fundamental algorithms for scientific computing in Python</description>
       <purl>pkg:pypi/scipy@1.11.3</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
@@ -117,7 +117,7 @@
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
@@ -126,7 +126,7 @@
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <purl>pkg:pypi/zipp@3.17.0</purl>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
index 09771000..51564a08 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
@@ -28,7 +28,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -94,7 +94,7 @@
       "name": "jax",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -930,7 +930,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
index 9f11da37..62ca3eba 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
@@ -41,7 +41,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="importlib-metadata@6.8.0">
@@ -84,7 +84,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="ml-dtypes@0.3.1">
@@ -595,7 +595,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
index 03fef41d..cbc23349 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
@@ -28,7 +28,7 @@
       "name": "colorama",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -94,7 +94,7 @@
       "name": "jax",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
@@ -930,7 +930,7 @@
       "name": "toml",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
index eaaba592..6de7012b 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
@@ -68,7 +68,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="importlib-metadata@6.8.0">
@@ -111,7 +111,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="ml-dtypes@0.3.1">
@@ -622,7 +622,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
index 23557569..c8dc23bb 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
@@ -28,7 +28,7 @@
       "name": "pyhumps",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
index f1f0b423..0d4447d0 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
@@ -41,7 +41,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
index 84f4560a..97226745 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
@@ -28,7 +28,7 @@
       "name": "pyhumps",
       "properties": [
         {
-          "name": "cdx:poetry:package:group",
+          "name": "cdx:poetry:group",
           "value": "main"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
index b0fab01b..c8a799ff 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
@@ -68,7 +68,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:poetry:package:group">main</property>
+        <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.0.xml.bin
new file mode 100644
index 00000000..7f9505ed
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.0.xml.bin
@@ -0,0 +1,61 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.1.xml.bin
new file mode 100644
index 00000000..a15cf69c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.1.xml.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin
new file mode 100644
index 00000000..1276fffe
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin
@@ -0,0 +1,134 @@
+{
+  "components": [
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "license-expression@30.1.1",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin
new file mode 100644
index 00000000..67ba78d2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin
@@ -0,0 +1,95 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
new file mode 100644
index 00000000..82b1cf1d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
@@ -0,0 +1,182 @@
+{
+  "components": [
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "license-expression@30.1.1",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
new file mode 100644
index 00000000..4dd8e2ae
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
@@ -0,0 +1,119 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin
new file mode 100644
index 00000000..b9d6b8ff
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin
@@ -0,0 +1,178 @@
+{
+  "components": [
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "license-expression@30.1.1",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin
new file mode 100644
index 00000000..305c9684
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin
@@ -0,0 +1,146 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.0.xml.bin
new file mode 100644
index 00000000..b81d4049
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.0.xml.bin
@@ -0,0 +1,229 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin
new file mode 100644
index 00000000..52e9023b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin
@@ -0,0 +1,201 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
new file mode 100644
index 00000000..c1beeb3b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
@@ -0,0 +1,428 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "name": "pkgutil-resolve-name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
new file mode 100644
index 00000000..1b549fa3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
@@ -0,0 +1,297 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
new file mode 100644
index 00000000..c1ae59a6
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
@@ -0,0 +1,602 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "name": "importlib-resources",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "name": "pkgutil-resolve-name",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "name": "zipp",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
new file mode 100644
index 00000000..bfa31ed8
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
@@ -0,0 +1,384 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
new file mode 100644
index 00000000..81e92cff
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
@@ -0,0 +1,598 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "name": "importlib-resources",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "name": "pkgutil-resolve-name",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "name": "zipp",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
new file mode 100644
index 00000000..88f38383
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
@@ -0,0 +1,411 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin
new file mode 100644
index 00000000..c5d1e4cf
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin
@@ -0,0 +1,221 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
new file mode 100644
index 00000000..b52cb485
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
@@ -0,0 +1,971 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
new file mode 100644
index 00000000..5d4bc77a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
@@ -0,0 +1,1431 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz"
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
+      "name": "pkgutil-resolve-name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
new file mode 100644
index 00000000..357c85d5
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
@@ -0,0 +1,1064 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
new file mode 100644
index 00000000..aabfba33
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
@@ -0,0 +1,2889 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz"
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
+      "name": "pkgutil-resolve-name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
new file mode 100644
index 00000000..cc228ab9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
@@ -0,0 +1,1793 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
new file mode 100644
index 00000000..afd64d9e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
@@ -0,0 +1,2885 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz"
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
+      "name": "pkgutil-resolve-name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
new file mode 100644
index 00000000..b4136aa6
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
@@ -0,0 +1,1820 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.0.xml.bin
new file mode 100644
index 00000000..09a1966e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.0.xml.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin
new file mode 100644
index 00000000..3a5f5dfc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
new file mode 100644
index 00000000..44a4c60c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
@@ -0,0 +1,127 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
new file mode 100644
index 00000000..c2d29676
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
@@ -0,0 +1,88 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
new file mode 100644
index 00000000..e5a27661
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
@@ -0,0 +1,177 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
new file mode 100644
index 00000000..e14b902f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
@@ -0,0 +1,111 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin
new file mode 100644
index 00000000..5844e5bc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin
@@ -0,0 +1,173 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin
new file mode 100644
index 00000000..73004a25
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin
@@ -0,0 +1,138 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.0.xml.bin
new file mode 100644
index 00000000..09a1966e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.0.xml.bin
@@ -0,0 +1,54 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin
new file mode 100644
index 00000000..0516f8eb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin
@@ -0,0 +1,103 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
new file mode 100644
index 00000000..1e4d6eee
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
@@ -0,0 +1,197 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
new file mode 100644
index 00000000..946eddbf
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
@@ -0,0 +1,144 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
new file mode 100644
index 00000000..03403cbb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
@@ -0,0 +1,299 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
new file mode 100644
index 00000000..37f7bb2c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
@@ -0,0 +1,195 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin
new file mode 100644
index 00000000..b453e0b8
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin
@@ -0,0 +1,295 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin
new file mode 100644
index 00000000..ba5c9169
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin
@@ -0,0 +1,222 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.0.xml.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.0.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.1.xml.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.1.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin
new file mode 100644
index 00000000..8e4fffc1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin
new file mode 100644
index 00000000..0f9b2e16
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin
new file mode 100644
index 00000000..67f8da1b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin
new file mode 100644
index 00000000..74764c25
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.4.json.bin
new file mode 100644
index 00000000..c4275512
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.4.json.bin
@@ -0,0 +1,29 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.4.xml.bin
new file mode 100644
index 00000000..7b67d0f9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.4.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.0.xml.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.0.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.1.xml.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.1.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin
new file mode 100644
index 00000000..8e4fffc1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin
new file mode 100644
index 00000000..0f9b2e16
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin
new file mode 100644
index 00000000..67f8da1b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin
new file mode 100644
index 00000000..74764c25
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.4.json.bin
new file mode 100644
index 00000000..c4275512
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.4.json.bin
@@ -0,0 +1,29 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.4.xml.bin
new file mode 100644
index 00000000..7b67d0f9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.4.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.0.xml.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.0.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.1.xml.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.1.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin
new file mode 100644
index 00000000..8e4fffc1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin
new file mode 100644
index 00000000..0f9b2e16
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin
new file mode 100644
index 00000000..67f8da1b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin
new file mode 100644
index 00000000..74764c25
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.4.json.bin
new file mode 100644
index 00000000..c4275512
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.4.json.bin
@@ -0,0 +1,29 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.4.xml.bin
new file mode 100644
index 00000000..7b67d0f9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.4.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 44abf407..8cb138ae 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -21,6 +21,7 @@
 from glob import glob
 from io import StringIO
 from os.path import basename, dirname, join
+from typing import Generator, Type, Any
 from unittest import TestCase
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
@@ -46,6 +47,10 @@
 ]
 
 
+def test_data_file_filter(s: str) -> Generator[Any, None, None]:
+    return ((n, d, sv, of) for n, d, sv, of in test_data if s in n)
+
+
 @ddt
 class TestPoetry(TestCase, SnapshotMixin):
 
@@ -94,7 +99,30 @@ def test_cli_fails_with_groups_not_found(self) -> None:
                       " 'MNE-with-C' (via with),"
                       " 'MNE-without-A' (via without),"
                       " 'MNE-without-B' (via without),"
-                      " 'MNE-without-C' (via without)", err)
+                      " 'MNE-without-C' (via without)"
+                      , err)
+
+    def test_cli_fails_with_extras_not_found(self) -> None:
+        projectdir = random.choice(projectdirs)
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    '-E', 'MNE-extra-C,MNE-extra-B',
+                    '--extras', 'MNE-extra-A',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn('Extra(s) ['
+                      "MNE-extra-A,"
+                      "MNE-extra-B,"
+                      "MNE-extra-C"
+                      '] not specified'
+                      , err)
 
     @named_data(*test_data)
     def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -116,5 +144,48 @@ def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of:
             make_comparable(out, of),
             f'{basename(dirname(projectdir))}-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
 
+    @named_data(*test_data_file_filter('group-deps'))
+    def test_cli_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    '--with', 'groupA',
+                    '--without', 'groupB,dev',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'some-groups-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+
+    @named_data(*test_data_file_filter('with-extras'))
+    def test_cli_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    '-E', 'my-extra',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'some-extras-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+
     def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
         super().assertEqualSnapshot(actual, join('poetry', snapshot_name))

From 536f7c609b44571ba6ae935e0bde71fe435db78a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 14:43:23 +0100
Subject: [PATCH 096/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py     |  4 +---
 cyclonedx_py/_internal/cli.py          |  2 +-
 cyclonedx_py/_internal/poetry.py       | 19 +++++++++++--------
 cyclonedx_py/_internal/requirements.py |  4 ++--
 tests/integration/test_poetry.py       |  8 +++-----
 5 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 16966edc..9a22a27f 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -17,6 +17,7 @@
 
 
 from abc import ABC, abstractmethod
+from enum import Enum
 from typing import TYPE_CHECKING, Any
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -44,9 +45,6 @@ def __call__(self, **kwargs: Any) -> 'Bom':  # pragma: no cover
         ...
 
 
-from enum import Enum
-
-
 class PropertyName(Enum):
     # region python
     # TODO: register -- name might not be final, find better one
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index fabd728b..e126ae05 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -109,7 +109,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
         ):
             spp = scbbc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
-                          help=spp.description.split('\n')[0].strip('. '),
+                          help=(spp.description or '').split('\n')[0].strip('. '),
                           description=spp.description,
                           epilog=spp.epilog,
                           parents=[spp, op, sco],
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 369cffd1..71c24d11 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -184,18 +184,20 @@ def __call__(self, *,  # type:ignore[override]
                 if gn not in po_cfg['group'].keys())
             self._logger.debug('groups_not_found: %r', groups_not_found)
             if len(groups_not_found) > 0:
-                error = GroupsNotFoundError(f'{gn!r} (via {srcn})' for gn, srcn in groups_not_found)
-                self._logger.error(error)
-                raise ValueError('some Poetry groups are unknown') from error
+                groups_error = GroupsNotFoundError(f'{gn!r} (via {srcn})' for gn, srcn in groups_not_found)
+                self._logger.error(groups_error)
+                raise ValueError('some Poetry groups are unknown') from groups_error
             del groups_not_found
 
-            extras_defined = set(po_cfg['extras'].keys())
             extras_s = set(filter(None, ','.join(extras).split(',')))
+            del extras
+            extras_defined = set(po_cfg['extras'].keys())
             extras_not_found = extras_s - extras_defined
             if len(extras_not_found) > 0:
-                error = ExtrasNotFoundError(extras_not_found)
-                self._logger.error(error)
-                raise ValueError('some package extras are unknown') from error
+                extras_error = ExtrasNotFoundError(extras_not_found)
+                self._logger.error(extras_error)
+                raise ValueError('some package extras are unknown') from extras_error
+            del extras_not_found
 
             if no_dev:
                 groups = {'main', }
@@ -226,8 +228,8 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         from cyclonedx.model import Property
 
-        from .utils.bom import make_bom
         from . import PropertyName
+        from .utils.bom import make_bom
 
         self._logger.debug('use_groups: %r', use_groups)
         self._logger.debug('use_extras: %r', use_extras)
@@ -378,6 +380,7 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
         from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentScope
         from packageurl import PackageURL
+
         from . import PropertyName
 
         return Component(
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 54431222..e771b36e 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -149,10 +149,10 @@ def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None,
     def _make_component(self, req: 'InstallRequirement',
                         index_url: str, extra_index_urls: Set[str]) -> 'Component':
         from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, Property, XsUri
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
-        from cyclonedx.model import Property
+
         from . import PropertyName
 
         name = req.name
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 8cb138ae..1276912f 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -21,7 +21,7 @@
 from glob import glob
 from io import StringIO
 from os.path import basename, dirname, join
-from typing import Generator, Type, Any
+from typing import Any, Generator
 from unittest import TestCase
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
@@ -99,8 +99,7 @@ def test_cli_fails_with_groups_not_found(self) -> None:
                       " 'MNE-with-C' (via with),"
                       " 'MNE-without-A' (via without),"
                       " 'MNE-without-B' (via without),"
-                      " 'MNE-without-C' (via without)"
-                      , err)
+                      " 'MNE-without-C' (via without)", err)
 
     def test_cli_fails_with_extras_not_found(self) -> None:
         projectdir = random.choice(projectdirs)
@@ -121,8 +120,7 @@ def test_cli_fails_with_extras_not_found(self) -> None:
                       "MNE-extra-A,"
                       "MNE-extra-B,"
                       "MNE-extra-C"
-                      '] not specified'
-                      , err)
+                      '] not specified', err)
 
     @named_data(*test_data)
     def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:

From 65cba339ad95a30441d1ea2a2091794c714f8dc1 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 14:43:57 +0100
Subject: [PATCH 097/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/infiles/poetry/TODO.txt | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/_data/infiles/poetry/TODO.txt b/tests/_data/infiles/poetry/TODO.txt
index 434dd66b..22b0d3f9 100644
--- a/tests/_data/infiles/poetry/TODO.txt
+++ b/tests/_data/infiles/poetry/TODO.txt
@@ -1,3 +1,2 @@
 - local deps
 - from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
-- extras , direct & transitive

From 2847620edb740f8f30299cd24eede6ee7cf7d6f6 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 15:07:05 +0100
Subject: [PATCH 098/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/infiles/poetry/private-packges/pypi-proxy.py | 2 +-
 tests/integration/test_poetry.py                         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
index 654430f5..5ef0311f 100755
--- a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
+++ b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
@@ -31,7 +31,7 @@
 class PypiProxyReqHandler(BaseHTTPRequestHandler):
     def do_GET(self) -> None:
         print('> ', self.path, file=sys.stderr)
-        p, m = urlretrieve(f'https://pypi.org{self.path}')
+        p, m = urlretrieve(f'https://pypi.org{self.path}')  # nosec B310
         print('< ', p, file=sys.stderr)
         self.send_response(200)
         for k, v in m.items():
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 1276912f..2fb9523c 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -72,7 +72,7 @@ def test_cli_fails_with_dir_not_found(self) -> None:
         self.assertIn("No such file or directory: 'something-that-must-not-exist.testing", err)
 
     def test_cli_fails_with_groups_not_found(self) -> None:
-        projectdir = random.choice(projectdirs)
+        projectdir = random.choice(projectdirs)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -102,7 +102,7 @@ def test_cli_fails_with_groups_not_found(self) -> None:
                       " 'MNE-without-C' (via without)", err)
 
     def test_cli_fails_with_extras_not_found(self) -> None:
-        projectdir = random.choice(projectdirs)
+        projectdir = random.choice(projectdirs)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'

From 76aedf63f0d2d48f22ae7e9ce9634eb01e45fe13 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 15:27:22 +0100
Subject: [PATCH 099/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py     | 11 ++++------
 cyclonedx_py/_internal/utils/toml.py | 31 ++++++++++++++++++++++++++++
 pyproject.toml                       |  2 +-
 3 files changed, 36 insertions(+), 8 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/toml.py

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 71c24d11..38620ad2 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -142,21 +142,18 @@ def __call__(self, *,  # type:ignore[override]
                  extras: List[str], all_extras: bool,
                  mc_type: 'ComponentType',
                  **kwargs: Any) -> 'Bom':
-        import sys
         from os.path import join
-        if sys.version_info < (3, 11):
-            from toml import loads as toml_loads
-        else:
-            from tomllib import loads as toml_loads
+
+        from .utils.toml import toml_loads
 
         pyproject_file = join(project_directory, 'pyproject.toml')
         lock_file = join(project_directory, 'poetry.lock')
         try:
-            pyproject = open(pyproject_file, 'rt', errors='replace')
+            pyproject = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
         except OSError as err:
             raise ValueError(f"can't open {pyproject_file!r}: {err}")
         try:
-            lock = open(lock_file, 'rt', errors='replace')
+            lock = open(lock_file, 'rt', encoding='utf8', errors='replace')
         except OSError as err:
             pyproject.close()
             raise ValueError(f"can't open {lock_file!r}: {err}")
diff --git a/cyclonedx_py/_internal/utils/toml.py b/cyclonedx_py/_internal/utils/toml.py
new file mode 100644
index 00000000..619a6b08
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/toml.py
@@ -0,0 +1,31 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+__all__ = ['toml_loads']
+
+import sys
+
+# TOML polyfill: https://github.com/hukkin/tomli#intro
+# A version of `tomli`, the `tomllib` module, was added to the standard library in Python 3.11 via PEP 680.
+# `Tomli` continues to provide a backport on PyPI for Python versions
+# where the standard library module is not available and that have not yet reached their end-of-life.
+if sys.version_info >= (3, 11):
+    from tomllib import loads as toml_loads
+else:
+    from tomli import loads as toml_loads
+
diff --git a/pyproject.toml b/pyproject.toml
index a35e8cb1..7c929bd0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -51,7 +51,7 @@ cyclonedx-python-lib = { version = "^5.1.1", extras = ['validation'] }
 packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
 setuptools = ">= 47.0.0"
-toml = { version = "^0.10.0", python = "<3.11" }
+tomli = { version = "^2.0.1", python = "<3.11" }
 chardet = "^5.1"
 
 [tool.poetry.group.dev.dependencies]

From 2e5084f2c513397610e686989119cb89733041bd Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 20:03:59 +0100
Subject: [PATCH 100/155] poetry extras

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              | 67 ++++++++++++-------
 .../poetry/some-extras-lock10-1.3.json.bin    |  8 +++
 .../poetry/some-extras-lock10-1.3.xml.bin     |  2 +
 .../poetry/some-extras-lock10-1.4.json.bin    |  8 +++
 .../poetry/some-extras-lock10-1.4.xml.bin     |  2 +
 .../poetry/some-extras-lock11-1.3.json.bin    | 12 ++++
 .../poetry/some-extras-lock11-1.3.xml.bin     |  3 +
 .../poetry/some-extras-lock11-1.4.json.bin    | 12 ++++
 .../poetry/some-extras-lock11-1.4.xml.bin     |  3 +
 .../poetry/some-extras-lock20-1.3.json.bin    | 14 ++++
 .../poetry/some-extras-lock20-1.3.xml.bin     |  5 ++
 .../poetry/some-extras-lock20-1.4.json.bin    | 14 ++++
 .../poetry/some-extras-lock20-1.4.xml.bin     |  5 ++
 13 files changed, 132 insertions(+), 23 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 38620ad2..36f77646 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,6 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, NamedTuple, Optional, Set
 
 from . import BomBuilder
@@ -35,11 +36,14 @@
 # TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
 
 
-class _LockEntry(NamedTuple):
+@dataclass
+class _LockEntry:
     name: str
     component: 'Component'
     dependencies: Set[str]
-    extras: Dict[str, Set[str]]
+    extra_deps: Dict[str, Set[str]]
+    added2bom: bool
+    added2bom_extras: Set[str]
 
 
 class GroupsNotFoundError(ValueError):
@@ -244,36 +248,50 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         lock_data: Dict[str, _LockEntry] = {le.name: le for le in self._parse_lock(locker)}
 
+        lock_data[root_c.name] = _LockEntry(  # needed for circle dependencies
+            name=root_c.name,
+            component=root_c,
+            dependencies=set(),
+            extra_deps=dict(),
+            added2bom=True,
+            added2bom_extras=use_extras
+        )
         extra_deps = set(chain.from_iterable(po_cfg['extras'][extra] for extra in use_extras))
 
-        _dep_pattern = re_compile(r'^(?P<name>.+?)(?:\[(?P<extras>.*?)\]])?$')
-        _added_components = set()  # required to prevent hickups and flips
+        _dep_pattern = re_compile(r'^(?P<name>[^\[]+)(?:\[(?P<extras>.*)\])?$')
 
-        def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
+        def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
             if name == 'python':
                 return None
             le = lock_data.get(name)
             if le is None:
                 self._logger.warning('skip unlocked component: %s', name)
                 return None
-            if id(le.component) in _added_components:
-                self._logger.debug('skipped existing component: %s', name)
-                return le.component
-            self._logger.debug('add component: %r', le.component)
-            bom.components.add(le.component)
-            _added_components.add(id(le.component))
+            _existed = le.added2bom
+            if not _existed:
+                self._logger.debug('add component: %r', le.component)
+                le.added2bom = True
+                bom.components.add(le.component)
+            missing_extras = extras - le.added2bom_extras
+            self._logger.debug('missing extras for %r: %r', le.component, missing_extras)
+            le.added2bom_extras.update(missing_extras)
+            le.component.properties.update(Property(
+                name=PropertyName.PackageExtra.value,
+                value=extra
+            ) for extra in missing_extras)
             depends_on = []
-            for dep in chain(
-                le.dependencies,
-                chain.from_iterable(le.extras.get(extra, []) for extra in extras)
-            ):
-                self._logger.debug('component %r depends on %r', name, dep)
+            for dep in set(chain(
+                [] if _existed else le.dependencies,
+                chain.from_iterable(le.extra_deps.get(extra, []) for extra in missing_extras)
+            )):
+                self._logger.debug('component %r depends on %r', le.component, dep)
                 depm = _dep_pattern.match(dep)
-                if depm is None:
+                if depm is None:  # pragma: nocover
+                    self._logger.warning('skipping malformed dependency: %r', dep)
                     continue
                 depends_on.append(_add_ld(
                     depm.group('name'),
-                    set(map(str.strip, (depm.group('extras') or '').split(',')))
+                    set(filter(None, map(str.strip, (depm.group('extras') or '').split(','))))
                 ))
             bom.register_dependency(le.component, filter(None, depends_on))
             return le.component
@@ -296,7 +314,7 @@ def _add_ld(name: str, extras: Iterable[str]) -> Optional['Component']:
                 if dep_spec.get('optional', False) and dep_name not in extra_deps:
                     self._logger.debug('skip optional dependency: %s', dep_name)
                     continue
-                depends_on.append(_add_ld(dep_name, dep_spec.get('extras') or []))
+                depends_on.append(_add_ld(dep_name, set(dep_spec.get('extras', []))))
         bom.register_dependency(root_c, filter(None, depends_on))
 
         return bom
@@ -351,10 +369,13 @@ def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
         for package in locker['package']:
             package.setdefault('files', metavar_files.get(package['name'], []))
             yield _LockEntry(
-                package['name'],
-                self.__make_component4lock(package),
-                set(package.get('dependencies', {}).keys()),
-                {e: set(d.split(' ')[0] for d in ds) for e, ds in package.get('extras', {}).items()}
+                name=package['name'],
+                component=self.__make_component4lock(package),
+                dependencies=set(dn for dn, ds in package.get('dependencies', {}).items()
+                                 if not isinstance(ds, dict) or not ds.get('optional', False)),
+                extra_deps={en: set(di.split(' ')[0] for di in ds) for en, ds in package.get('extras', {}).items()},
+                added2bom=False,
+                added2bom_extras=set()
             )
 
     def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None, None]:
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
index 82b1cf1d..8cd95ae9 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
@@ -23,6 +23,14 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
         }
       ],
       "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
index 4dd8e2ae..f42ded4d 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
@@ -42,6 +42,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin
index b9d6b8ff..22c3c25e 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin
@@ -23,6 +23,14 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
         }
       ],
       "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin
index 305c9684..b3d04699 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin
@@ -69,6 +69,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
index c1ae59a6..9ec58d64 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
@@ -53,6 +53,14 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
         }
       ],
       "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
@@ -158,6 +166,10 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
         }
       ],
       "purl": "pkg:pypi/jsonschema@4.19.2",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
index bfa31ed8..13e54d4a 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
@@ -62,6 +62,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -132,6 +134,7 @@
       <purl>pkg:pypi/jsonschema@4.19.2</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
index 81e92cff..ca7ce7df 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
@@ -53,6 +53,14 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
         }
       ],
       "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
@@ -158,6 +166,10 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
         }
       ],
       "purl": "pkg:pypi/jsonschema@4.19.2",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
index 88f38383..a9715029 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
@@ -89,6 +89,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -159,6 +161,7 @@
       <purl>pkg:pypi/jsonschema@4.19.2</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
index aabfba33..111ac8bf 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
@@ -92,6 +92,14 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
         }
       ],
       "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
@@ -311,6 +319,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.19.2",
       "scope": "optional",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
index cc228ab9..3f9fc4e0 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
@@ -88,6 +88,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -236,6 +238,9 @@
           </hashes>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
       <name>jsonschema-specifications</name>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
index afd64d9e..c6b3f6b6 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
@@ -92,6 +92,14 @@
         {
           "name": "cdx:poetry:group",
           "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
         }
       ],
       "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
@@ -311,6 +319,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.19.2",
       "scope": "optional",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
index b4136aa6..3f992213 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
@@ -115,6 +115,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -263,6 +265,9 @@
           </hashes>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
       <name>jsonschema-specifications</name>

From 5a89bbe0615a29e17548f4cecec2a8eb3b30d751 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 23:51:46 +0100
Subject: [PATCH 101/155] poetry win tests

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 ...n-issue448.cp1252.txt.bin-1.0.xml-file.bin | 26 ++++++
 ...n-issue448.cp1252.txt.bin-1.1.xml-file.bin | 41 +++++++++
 ...-issue448.cp1252.txt.bin-1.2.json-file.bin | 78 +++++++++++++++++
 ...n-issue448.cp1252.txt.bin-1.2.xml-file.bin | 60 +++++++++++++
 ...-issue448.cp1252.txt.bin-1.3.json-file.bin | 78 +++++++++++++++++
 ...n-issue448.cp1252.txt.bin-1.3.xml-file.bin | 60 +++++++++++++
 ...-issue448.cp1252.txt.bin-1.4.json-file.bin | 71 ++++++++++++++++
 ...n-issue448.cp1252.txt.bin-1.4.xml-file.bin | 84 +++++++++++++++++++
 8 files changed, 498 insertions(+)
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin

diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin
new file mode 100644
index 00000000..385653e0
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin
new file mode 100644
index 00000000..77a418d7
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin
@@ -0,0 +1,41 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
new file mode 100644
index 00000000..05654e4e
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
@@ -0,0 +1,78 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
new file mode 100644
index 00000000..c2cbb014
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
@@ -0,0 +1,60 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
new file mode 100644
index 00000000..58b4aa00
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
@@ -0,0 +1,78 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
new file mode 100644
index 00000000..98094dce
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
@@ -0,0 +1,60 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
new file mode 100644
index 00000000..853bed26
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
@@ -0,0 +1,71 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
new file mode 100644
index 00000000..f6fd70b1
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
@@ -0,0 +1,84 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>

From d212c5e983a74ebc30707e03ba796db71ae04e07 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 23:33:30 +0100
Subject: [PATCH 102/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py     | 2 +-
 cyclonedx_py/_internal/utils/toml.py | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 36f77646..a0910d13 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -17,7 +17,7 @@
 
 
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, NamedTuple, Optional, Set
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, Optional, Set
 
 from . import BomBuilder
 
diff --git a/cyclonedx_py/_internal/utils/toml.py b/cyclonedx_py/_internal/utils/toml.py
index 619a6b08..a53c5cc9 100644
--- a/cyclonedx_py/_internal/utils/toml.py
+++ b/cyclonedx_py/_internal/utils/toml.py
@@ -28,4 +28,3 @@
     from tomllib import loads as toml_loads
 else:
     from tomli import loads as toml_loads
-

From 7e5189defedc7e22144776c2e565cefb5e72ba8e Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 13 Nov 2023 23:59:20 +0100
Subject: [PATCH 103/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/__init__.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/__init__.py b/tests/__init__.py
index 6f1eef2c..961f4f56 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -45,12 +45,12 @@ def getSnapshotFile(snapshot_name: str) -> str:  # noqa: N802
 
     @classmethod
     def writeSnapshot(cls, snapshot_name: str, data: str) -> None:  # noqa: N802
-        with open(cls.getSnapshotFile(snapshot_name), 'w') as s:
+        with open(cls.getSnapshotFile(snapshot_name), 'wt', encoding='utf8') as s:
             s.write(data)
 
     @classmethod
     def readSnapshot(cls, snapshot_name: str) -> str:  # noqa: N802
-        with open(cls.getSnapshotFile(snapshot_name), 'r') as s:
+        with open(cls.getSnapshotFile(snapshot_name), 'rt', encoding='utf8') as s:
             return s.read()
 
     def assertEqualSnapshot(self: Union[TestCase, 'SnapshotMixin'],  # noqa: N802

From ade4f2eb302f2cb3964b7da4dfcb95f887a282ae Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 00:07:54 +0100
Subject: [PATCH 104/155] poetry win tests

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/__init__.py                             |   8 +-
 ...n-issue448.cp1252.txt.bin-1.0.xml-file.bin |  52 +++---
 ...n-issue448.cp1252.txt.bin-1.1.xml-file.bin |  82 ++++-----
 ...-issue448.cp1252.txt.bin-1.2.json-file.bin | 154 ++++++++--------
 ...n-issue448.cp1252.txt.bin-1.2.xml-file.bin | 120 ++++++-------
 ...-issue448.cp1252.txt.bin-1.3.json-file.bin | 154 ++++++++--------
 ...n-issue448.cp1252.txt.bin-1.3.xml-file.bin | 120 ++++++-------
 ...-issue448.cp1252.txt.bin-1.4.json-file.bin | 140 +++++++--------
 ...n-issue448.cp1252.txt.bin-1.4.xml-file.bin | 168 +++++++++---------
 9 files changed, 499 insertions(+), 499 deletions(-)

diff --git a/tests/__init__.py b/tests/__init__.py
index 961f4f56..de182996 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -45,13 +45,13 @@ def getSnapshotFile(snapshot_name: str) -> str:  # noqa: N802
 
     @classmethod
     def writeSnapshot(cls, snapshot_name: str, data: str) -> None:  # noqa: N802
-        with open(cls.getSnapshotFile(snapshot_name), 'wt', encoding='utf8') as s:
-            s.write(data)
+        with open(cls.getSnapshotFile(snapshot_name), 'wt', encoding='utf8', newline='\n') as sf:
+            sf.write(data)
 
     @classmethod
     def readSnapshot(cls, snapshot_name: str) -> str:  # noqa: N802
-        with open(cls.getSnapshotFile(snapshot_name), 'rt', encoding='utf8') as s:
-            return s.read()
+        with open(cls.getSnapshotFile(snapshot_name), 'rt', encoding='utf8', newline='\n') as sf:
+            return sf.read()
 
     def assertEqualSnapshot(self: Union[TestCase, 'SnapshotMixin'],  # noqa: N802
                             actual: str, snapshot_name: str) -> None:
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin
index 385653e0..5382704a 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin
@@ -1,26 +1,26 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
-  <components>
-    <component type="library">
-      <name>packageurl-python</name>
-      <version/>
-      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
-      <purl>pkg:pypi/packageurl-python</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>requirements_parser</name>
-      <version/>
-      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
-      <purl>pkg:pypi/requirements-parser</purl>
-      <modified>false</modified>
-    </component>
-    <component type="library">
-      <name>setuptools</name>
-      <version/>
-      <description>requirements line 8: setuptools&gt;=50.3.2</description>
-      <purl>pkg:pypi/setuptools</purl>
-      <modified>false</modified>
-    </component>
-  </components>
-</bom>
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin
index 77a418d7..9143afde 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin
@@ -1,41 +1,41 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
-  <components>
-    <component type="library" bom-ref="requirements-L6">
-      <name>packageurl-python</name>
-      <version/>
-      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
-      <purl>pkg:pypi/packageurl-python</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/packageurl-python/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L7">
-      <name>requirements_parser</name>
-      <version/>
-      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
-      <purl>pkg:pypi/requirements-parser</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/requirements_parser/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L8">
-      <name>setuptools</name>
-      <version/>
-      <description>requirements line 8: setuptools&gt;=50.3.2</description>
-      <purl>pkg:pypi/setuptools</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/setuptools/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-</bom>
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
index 05654e4e..36834eac 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
@@ -1,78 +1,78 @@
-{
-  "components": [
-    {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: packageurl-python>=0.9.4",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/packageurl-python/"
-        }
-      ],
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python",
-      "type": "library",
-      "version": ""
-    },
-    {
-      "bom-ref": "requirements-L7",
-      "description": "requirements line 7: requirements_parser>=0.2.0",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/requirements_parser/"
-        }
-      ],
-      "name": "requirements_parser",
-      "purl": "pkg:pypi/requirements-parser",
-      "type": "library",
-      "version": ""
-    },
-    {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: setuptools>=50.3.2",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/setuptools/"
-        }
-      ],
-      "name": "setuptools",
-      "purl": "pkg:pypi/setuptools",
-      "type": "library",
-      "version": ""
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "requirements-L6"
-    },
-    {
-      "ref": "requirements-L7"
-    },
-    {
-      "ref": "requirements-L8"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.1.1"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.2"
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
 }
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
index c2cbb014..1ca5c82f 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
@@ -1,60 +1,60 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-bom</name>
-        <version>thisVersion-testing</version>
-      </tool>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="requirements-L6">
-      <name>packageurl-python</name>
-      <version/>
-      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
-      <purl>pkg:pypi/packageurl-python</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/packageurl-python/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L7">
-      <name>requirements_parser</name>
-      <version/>
-      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
-      <purl>pkg:pypi/requirements-parser</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/requirements_parser/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L8">
-      <name>setuptools</name>
-      <version/>
-      <description>requirements line 8: setuptools&gt;=50.3.2</description>
-      <purl>pkg:pypi/setuptools</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/setuptools/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L7"/>
-    <dependency ref="requirements-L8"/>
-  </dependencies>
-</bom>
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
index 58b4aa00..17a92546 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
@@ -1,78 +1,78 @@
-{
-  "components": [
-    {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: packageurl-python>=0.9.4",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/packageurl-python/"
-        }
-      ],
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python",
-      "type": "library",
-      "version": ""
-    },
-    {
-      "bom-ref": "requirements-L7",
-      "description": "requirements line 7: requirements_parser>=0.2.0",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/requirements_parser/"
-        }
-      ],
-      "name": "requirements_parser",
-      "purl": "pkg:pypi/requirements-parser",
-      "type": "library",
-      "version": ""
-    },
-    {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: setuptools>=50.3.2",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/setuptools/"
-        }
-      ],
-      "name": "setuptools",
-      "purl": "pkg:pypi/setuptools",
-      "type": "library",
-      "version": ""
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "requirements-L6"
-    },
-    {
-      "ref": "requirements-L7"
-    },
-    {
-      "ref": "requirements-L8"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "name": "cyclonedx-bom",
-        "vendor": "CycloneDX",
-        "version": "thisVersion-testing"
-      },
-      {
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.1.1"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.3"
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
 }
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
index 98094dce..b6e887b0 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
@@ -1,60 +1,60 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-bom</name>
-        <version>thisVersion-testing</version>
-      </tool>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="requirements-L6">
-      <name>packageurl-python</name>
-      <version/>
-      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
-      <purl>pkg:pypi/packageurl-python</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/packageurl-python/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L7">
-      <name>requirements_parser</name>
-      <version/>
-      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
-      <purl>pkg:pypi/requirements-parser</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/requirements_parser/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L8">
-      <name>setuptools</name>
-      <version/>
-      <description>requirements line 8: setuptools&gt;=50.3.2</description>
-      <purl>pkg:pypi/setuptools</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/setuptools/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L7"/>
-    <dependency ref="requirements-L8"/>
-  </dependencies>
-</bom>
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <version/>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <version/>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <version/>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
index 853bed26..07dc044d 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
@@ -1,71 +1,71 @@
-{
-  "components": [
-    {
-      "bom-ref": "requirements-L6",
-      "description": "requirements line 6: packageurl-python>=0.9.4",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/packageurl-python/"
-        }
-      ],
-      "name": "packageurl-python",
-      "purl": "pkg:pypi/packageurl-python",
-      "type": "library"
-    },
-    {
-      "bom-ref": "requirements-L7",
-      "description": "requirements line 7: requirements_parser>=0.2.0",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/requirements_parser/"
-        }
-      ],
-      "name": "requirements_parser",
-      "purl": "pkg:pypi/requirements-parser",
-      "type": "library"
-    },
-    {
-      "bom-ref": "requirements-L8",
-      "description": "requirements line 8: setuptools>=50.3.2",
-      "externalReferences": [
-        {
-          "comment": "implicit dist url",
-          "type": "distribution",
-          "url": "https://pypi.org/simple/setuptools/"
-        }
-      ],
-      "name": "setuptools",
-      "purl": "pkg:pypi/setuptools",
-      "type": "library"
-    }
-  ],
-  "dependencies": [
-    {
-      "ref": "requirements-L6"
-    },
-    {
-      "ref": "requirements-L7"
-    },
-    {
-      "ref": "requirements-L8"
-    }
-  ],
-  "metadata": {
-    "tools": [
-      {
-        "externalReferences": [   ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "libVersion-testing"
-      }
-    ]
-  },
-  "version": 1,
-  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "bomFormat": "CycloneDX",
-  "specVersion": "1.4"
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
 }
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
index f6fd70b1..39b06991 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
@@ -1,84 +1,84 @@
-<?xml version="1.0" ?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
-  <metadata>
-    <tools>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-bom</name>
-        <version>thisVersion-testing</version>
-        <externalReferences>
-          <reference type="build-system">
-            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
-          </reference>
-          <reference type="distribution">
-            <url>https://pypi.org/project/cyclonedx-bom/</url>
-          </reference>
-          <reference type="documentation">
-            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
-          </reference>
-          <reference type="issue-tracker">
-            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
-          </reference>
-          <reference type="license">
-            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
-          </reference>
-          <reference type="release-notes">
-            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
-          </reference>
-          <reference type="vcs">
-            <url>https://github.com/CycloneDX/cyclonedx-python</url>
-          </reference>
-          <reference type="website">
-            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
-          </reference>
-        </externalReferences>
-      </tool>
-      <tool>
-        <vendor>CycloneDX</vendor>
-        <name>cyclonedx-python-lib</name>
-        <version>libVersion-testing</version>
-        <externalReferences><!-- stripped --></externalReferences>
-      </tool>
-    </tools>
-  </metadata>
-  <components>
-    <component type="library" bom-ref="requirements-L6">
-      <name>packageurl-python</name>
-      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
-      <purl>pkg:pypi/packageurl-python</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/packageurl-python/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L7">
-      <name>requirements_parser</name>
-      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
-      <purl>pkg:pypi/requirements-parser</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/requirements_parser/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-    <component type="library" bom-ref="requirements-L8">
-      <name>setuptools</name>
-      <description>requirements line 8: setuptools&gt;=50.3.2</description>
-      <purl>pkg:pypi/setuptools</purl>
-      <externalReferences>
-        <reference type="distribution">
-          <url>https://pypi.org/simple/setuptools/</url>
-          <comment>implicit dist url</comment>
-        </reference>
-      </externalReferences>
-    </component>
-  </components>
-  <dependencies>
-    <dependency ref="requirements-L6"/>
-    <dependency ref="requirements-L7"/>
-    <dependency ref="requirements-L8"/>
-  </dependencies>
-</bom>
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>

From f867e673302c05f0a8009f6a9edf055d49d4b19c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 14:06:29 +0100
Subject: [PATCH 105/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py |  2 +
 cyclonedx_py/_internal/poetry.py   | 66 ++++++++++++++++++++++--------
 2 files changed, 51 insertions(+), 17 deletions(-)

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 9a22a27f..5d231707 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -54,6 +54,8 @@ class PropertyName(Enum):
     # region poetry
     # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/poetry.md
     PoetryGroup = 'cdx:poetry:group'
+    PoetryPackageSourceReference = 'cdx:poetry:source:package:reference'
+    PoetryPackageSourceResolvedReference = 'cdx:poetry:package:source:resolved_reference'
     # endregion poetry
 
     # region pipenv
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index a0910d13..0527cd96 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -391,16 +391,14 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
                     del error
 
     def __make_component4lock(self, package: 'NameDict') -> 'Component':
-        # TODO:
-        #   - local deps
-        #   - from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
-
         from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentScope
         from packageurl import PackageURL
 
         from . import PropertyName
 
+        package.setdefault('source', {})
+
         return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
             name=package['name'],
@@ -408,10 +406,20 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
             description=package.get('description'),
             scope=ComponentScope.OPTIONAL if package.get('optional') else None,
             external_references=self.__extrefs4lock(package),
-            properties=[Property(  # for backwards compatibility: category -> group
-                name=PropertyName.PoetryGroup.value,
-                value=package['category']
-            )] if 'category' in package else [],
+            properties=filter(lambda p: p and p.value, [  # type: ignore[arg-type]
+                Property(  # for backwards compatibility: category -> group
+                    name=PropertyName.PoetryGroup.value,
+                    value=package['category']
+                ) if 'category' in package else None,
+                Property(
+                    name=PropertyName.PoetryPackageSourceReference.value,
+                    value=package['source']['reference']
+                ) if 'reference' in package['source'] else None,
+                Property(
+                    name=PropertyName.PoetryPackageSourceResolvedReference.value,
+                    value=package['source']['resolved_reference']
+                ) if 'resolved_reference' in package['source'] else None,
+            ]),
             purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
         )
 
@@ -419,18 +427,42 @@ def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference',
         from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
 
-        source = package.get('source', {'type': 'legacy', 'url': 'https://pypi.org/simple'})
-        if source.get('type') != 'legacy' or not source.get('url'):
-            return
+        # TODO:
+        #   - local deps
 
-        for file in package.get('files', []):
+        source_type = package['source'].get('type', 'legacy')
+        if 'legacy' == source_type:
+            source_url = package['source'].get('url', 'https://pypi.org/simple')
+            for file in package['files']:
+                try:
+                    yield ExternalReference(
+                        comment='from legacy-api',
+                        type=ExternalReferenceType.DISTRIBUTION,
+                        url=XsUri(f'{source_url}/{package["name"]}/#{file["file"]}'),
+                        hashes=[HashType.from_composite_str(file['hash'])]
+                    )
+                except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
+                    self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
+                    del error
+        elif 'url' == source_type:
             try:
                 yield ExternalReference(
+                    comment='from url',
                     type=ExternalReferenceType.DISTRIBUTION,
-                    url=XsUri(f'{source["url"]}/{package["name"]}/#{file["file"]}'),
-                    hashes=[HashType.from_composite_str(file['hash'])]
+                    url=XsUri(package['source']['url']),
+                    hashes=[HashType.from_composite_str(package['files'][0]['hash'])] if len(package['files']) else None
+                )
+            except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
+                self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+                del error
+        elif 'git' == source_type:
+            try:
+                yield ExternalReference(
+                    comment=f'from git (resolved_reference={package["source"].get("resolved_reference")})',
+                    type=ExternalReferenceType.VCS,
+                    url=XsUri(f'git+{package["source"]["url"]}#{package["source"].get("reference")}')
+                    # no hashes, has source.reference instead, which is a property
                 )
-            except (InvalidUriException, UnknownHashTypeException) as error:
-                self._logger.debug('%s skipped dist-extRef for: %r', package['name'], file,
-                                   exc_info=error)
+            except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
+                self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
                 del error

From 2ba378b5809890b266b3e133d13107bac6050aae Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 14:27:28 +0100
Subject: [PATCH 106/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 0527cd96..02a31c58 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -268,21 +268,23 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
                 self._logger.warning('skip unlocked component: %s', name)
                 return None
             _existed = le.added2bom
-            if not _existed:
+            if _existed:
+                self._logger.debug('existing component: %r', le.component)
+            else:
                 self._logger.debug('add component: %r', le.component)
                 le.added2bom = True
                 bom.components.add(le.component)
-            missing_extras = extras - le.added2bom_extras
-            self._logger.debug('missing extras for %r: %r', le.component, missing_extras)
-            le.added2bom_extras.update(missing_extras)
+            new_extras = extras - le.added2bom_extras
+            self._logger.debug('new extras for %r: %r', le.component, new_extras)
+            le.added2bom_extras.update(new_extras)
             le.component.properties.update(Property(
                 name=PropertyName.PackageExtra.value,
                 value=extra
-            ) for extra in missing_extras)
+            ) for extra in new_extras)
             depends_on = []
             for dep in set(chain(
                 [] if _existed else le.dependencies,
-                chain.from_iterable(le.extra_deps.get(extra, []) for extra in missing_extras)
+                chain.from_iterable(le.extra_deps.get(extra, []) for extra in new_extras)
             )):
                 self._logger.debug('component %r depends on %r', le.component, dep)
                 depm = _dep_pattern.match(dep)
@@ -390,6 +392,12 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
                     self._logger.debug('skipping hash %s', file['hash'], exc_info=error)
                     del error
 
+    __PACKAGE_SRC_VCS = ['git']
+
+    @classmethod
+    def __is_package_src_vcs(cls, package: 'NameDict') -> bool:
+        return package['source'].get('type') in cls.__PACKAGE_SRC_VCS
+
     def __make_component4lock(self, package: 'NameDict') -> 'Component':
         from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentScope
@@ -414,11 +422,11 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
                 Property(
                     name=PropertyName.PoetryPackageSourceReference.value,
                     value=package['source']['reference']
-                ) if 'reference' in package['source'] else None,
+                ) if self.__is_package_src_vcs(package) and 'reference' in package['source'] else None,
                 Property(
                     name=PropertyName.PoetryPackageSourceResolvedReference.value,
                     value=package['source']['resolved_reference']
-                ) if 'resolved_reference' in package['source'] else None,
+                ) if self.__is_package_src_vcs(package) and 'resolved_reference' in package['source'] else None,
             ]),
             purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
         )
@@ -442,7 +450,7 @@ def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference',
                         hashes=[HashType.from_composite_str(file['hash'])]
                     )
                 except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
-                    self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
+                    self._logger.debug('skipped dist-extRef for: %r | %r', package['name'], file, exc_info=error)
                     del error
         elif 'url' == source_type:
             try:
@@ -455,7 +463,7 @@ def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference',
             except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
                 self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
                 del error
-        elif 'git' == source_type:
+        elif source_type in self.__PACKAGE_SRC_VCS:
             try:
                 yield ExternalReference(
                     comment=f'from git (resolved_reference={package["source"].get("resolved_reference")})',

From 5d90caf6c75cbc491c11972dba3c115c28b45916 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 14:37:47 +0100
Subject: [PATCH 107/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 02a31c58..c94e49d7 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -365,7 +365,7 @@ def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
         lock_version = tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
         self._logger.debug('lock_version: %r', lock_version)
 
-        metavar_files = locker['metavar'].get('files', {}) if lock_version < (2,) else {}
+        metavar_files = locker['metadata'].get('files', {}) if lock_version < (2,) else {}
 
         package: 'NameDict'
         for package in locker['package']:
@@ -439,6 +439,7 @@ def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference',
         #   - local deps
 
         source_type = package['source'].get('type', 'legacy')
+        self._logger.debug('ref 4 package files = %r', package['files'])
         if 'legacy' == source_type:
             source_url = package['source'].get('url', 'https://pypi.org/simple')
             for file in package['files']:

From 5d327fef37ebf3272fecefa49af24b3b632b9915 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 14:40:33 +0100
Subject: [PATCH 108/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index c94e49d7..bb93a984 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -370,6 +370,7 @@ def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
         package: 'NameDict'
         for package in locker['package']:
             package.setdefault('files', metavar_files.get(package['name'], []))
+            package.setdefault('source', {})
             yield _LockEntry(
                 name=package['name'],
                 component=self.__make_component4lock(package),
@@ -405,8 +406,6 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
 
         from . import PropertyName
 
-        package.setdefault('source', {})
-
         return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
             name=package['name'],

From a21355bdfd9559b9ac3f376bc50143244ecf022e Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 15:07:40 +0100
Subject: [PATCH 109/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index bb93a984..2022ee71 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -246,7 +246,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
         ) for extra in use_extras)
         self._logger.debug('root-component: %r', root_c)
 
-        lock_data: Dict[str, _LockEntry] = {le.name: le for le in self._parse_lock(locker)}
+        lock_data: Dict[str, _LockEntry] = {le.name.lower(): le for le in self._parse_lock(locker)}
 
         lock_data[root_c.name] = _LockEntry(  # needed for circle dependencies
             name=root_c.name,
@@ -256,11 +256,12 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
             added2bom=True,
             added2bom_extras=use_extras
         )
-        extra_deps = set(chain.from_iterable(po_cfg['extras'][extra] for extra in use_extras))
+        extra_deps = set(map(str.lower, chain.from_iterable(po_cfg['extras'][extra] for extra in use_extras)))
 
         _dep_pattern = re_compile(r'^(?P<name>[^\[]+)(?:\[(?P<extras>.*)\])?$')
 
         def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
+            name = name.lower()
             if name == 'python':
                 return None
             le = lock_data.get(name)
@@ -302,6 +303,7 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
         for group_name in use_groups:
             self._logger.debug('processing group %r ...', group_name)
             for dep_name, dep_spec in po_cfg['group'][group_name].get('dependencies', {}).items():
+                dep_name = dep_name.lower()
                 self._logger.debug('root-component depends on %s', dep_name)
                 if dep_name == 'python':
                     continue
@@ -438,7 +440,6 @@ def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference',
         #   - local deps
 
         source_type = package['source'].get('type', 'legacy')
-        self._logger.debug('ref 4 package files = %r', package['files'])
         if 'legacy' == source_type:
             source_url = package['source'].get('url', 'https://pypi.org/simple')
             for file in package['files']:

From 2eff3c43da02c93ea372639bdcc3fc9cd8a6fce0 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 15:11:15 +0100
Subject: [PATCH 110/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/infiles/poetry/TODO.txt           |   10 +-
 .../poetry/with-urls/lock10/poetry.lock       |   70 +
 .../poetry/with-urls/lock10/pyproject.toml    |    1 +
 .../poetry/with-urls/lock11/poetry.lock       |   71 +
 .../poetry/with-urls/lock11/pyproject.toml    |    1 +
 .../poetry/with-urls/lock20/poetry.lock       |   75 +
 .../poetry/with-urls/lock20/pyproject.toml    |    1 +
 .../poetry/with-urls/pyproject-proto.toml     |   13 +-
 .../poetry/group-deps-lock11-1.1.xml.bin      |   70 +
 .../poetry/group-deps-lock11-1.2.json.bin     |   84 +
 .../poetry/group-deps-lock11-1.2.xml.bin      |   70 +
 .../poetry/group-deps-lock11-1.3.json.bin     |  168 ++
 .../poetry/group-deps-lock11-1.3.xml.bin      |  112 ++
 .../poetry/group-deps-lock11-1.4.json.bin     |  168 ++
 .../poetry/group-deps-lock11-1.4.xml.bin      |  112 ++
 .../poetry/group-deps-lock20-1.1.xml.bin      |   14 +
 .../poetry/group-deps-lock20-1.2.json.bin     |   14 +
 .../poetry/group-deps-lock20-1.2.xml.bin      |   14 +
 .../poetry/group-deps-lock20-1.3.json.bin     |   14 +
 .../poetry/group-deps-lock20-1.3.xml.bin      |   14 +
 .../poetry/group-deps-lock20-1.4.json.bin     |   14 +
 .../poetry/group-deps-lock20-1.4.xml.bin      |   14 +
 .../poetry/main-and-dev-lock10-1.1.xml.bin    |   40 +
 .../poetry/main-and-dev-lock10-1.2.json.bin   |   48 +
 .../poetry/main-and-dev-lock10-1.2.xml.bin    |   40 +
 .../poetry/main-and-dev-lock10-1.3.json.bin   |   96 ++
 .../poetry/main-and-dev-lock10-1.3.xml.bin    |   64 +
 .../poetry/main-and-dev-lock10-1.4.json.bin   |   96 ++
 .../poetry/main-and-dev-lock10-1.4.xml.bin    |   64 +
 .../poetry/main-and-dev-lock11-1.1.xml.bin    |   70 +
 .../poetry/main-and-dev-lock11-1.2.json.bin   |   84 +
 .../poetry/main-and-dev-lock11-1.2.xml.bin    |   70 +
 .../poetry/main-and-dev-lock11-1.3.json.bin   |  168 ++
 .../poetry/main-and-dev-lock11-1.3.xml.bin    |  112 ++
 .../poetry/main-and-dev-lock11-1.4.json.bin   |  168 ++
 .../poetry/main-and-dev-lock11-1.4.xml.bin    |  112 ++
 .../poetry/main-and-dev-lock20-1.1.xml.bin    |   14 +
 .../poetry/main-and-dev-lock20-1.2.json.bin   |   14 +
 .../poetry/main-and-dev-lock20-1.2.xml.bin    |   14 +
 .../poetry/main-and-dev-lock20-1.3.json.bin   |   14 +
 .../poetry/main-and-dev-lock20-1.3.xml.bin    |   14 +
 .../poetry/main-and-dev-lock20-1.4.json.bin   |   14 +
 .../poetry/main-and-dev-lock20-1.4.xml.bin    |   14 +
 .../poetry/private-packges-lock10-1.1.xml.bin |   20 +
 .../private-packges-lock10-1.2.json.bin       |   24 +
 .../poetry/private-packges-lock10-1.2.xml.bin |   20 +
 .../private-packges-lock10-1.3.json.bin       |   48 +
 .../poetry/private-packges-lock10-1.3.xml.bin |   32 +
 .../private-packges-lock10-1.4.json.bin       |   48 +
 .../poetry/private-packges-lock10-1.4.xml.bin |   32 +
 .../poetry/private-packges-lock11-1.1.xml.bin |  362 ++++
 .../private-packges-lock11-1.2.json.bin       |  448 +++++
 .../poetry/private-packges-lock11-1.2.xml.bin |  362 ++++
 .../private-packges-lock11-1.3.json.bin       |  964 +++++++++++
 .../poetry/private-packges-lock11-1.3.xml.bin |  620 +++++++
 .../private-packges-lock11-1.4.json.bin       |  964 +++++++++++
 .../poetry/private-packges-lock11-1.4.xml.bin |  620 +++++++
 .../poetry/private-packges-lock20-1.1.xml.bin |   86 +
 .../private-packges-lock20-1.2.json.bin       |   86 +
 .../poetry/private-packges-lock20-1.2.xml.bin |   86 +
 .../private-packges-lock20-1.3.json.bin       |   86 +
 .../poetry/private-packges-lock20-1.3.xml.bin |   86 +
 .../private-packges-lock20-1.4.json.bin       |   86 +
 .../poetry/private-packges-lock20-1.4.xml.bin |   86 +
 .../regression-issue611-lock20-1.1.xml.bin    |    2 +
 .../regression-issue611-lock20-1.2.json.bin   |    2 +
 .../regression-issue611-lock20-1.2.xml.bin    |    2 +
 .../regression-issue611-lock20-1.3.json.bin   |    2 +
 .../regression-issue611-lock20-1.3.xml.bin    |    2 +
 .../regression-issue611-lock20-1.4.json.bin   |    2 +
 .../regression-issue611-lock20-1.4.xml.bin    |    2 +
 .../poetry/some-extras-lock11-1.1.xml.bin     |  578 +++++++
 .../poetry/some-extras-lock11-1.2.json.bin    |  713 ++++++++
 .../poetry/some-extras-lock11-1.2.xml.bin     |  578 +++++++
 .../poetry/some-extras-lock11-1.3.json.bin    | 1523 +++++++++++++++++
 .../poetry/some-extras-lock11-1.3.xml.bin     |  983 +++++++++++
 .../poetry/some-extras-lock11-1.4.json.bin    | 1523 +++++++++++++++++
 .../poetry/some-extras-lock11-1.4.xml.bin     |  983 +++++++++++
 .../poetry/some-extras-lock20-1.1.xml.bin     |  241 +++
 .../poetry/some-extras-lock20-1.2.json.bin    |  241 +++
 .../poetry/some-extras-lock20-1.2.xml.bin     |  241 +++
 .../poetry/some-extras-lock20-1.3.json.bin    |  241 +++
 .../poetry/some-extras-lock20-1.3.xml.bin     |  241 +++
 .../poetry/some-extras-lock20-1.4.json.bin    |  241 +++
 .../poetry/some-extras-lock20-1.4.xml.bin     |  241 +++
 .../poetry/some-groups-lock11-1.1.xml.bin     |   70 +
 .../poetry/some-groups-lock11-1.2.json.bin    |   84 +
 .../poetry/some-groups-lock11-1.2.xml.bin     |   70 +
 .../poetry/some-groups-lock11-1.3.json.bin    |  168 ++
 .../poetry/some-groups-lock11-1.3.xml.bin     |  112 ++
 .../poetry/some-groups-lock11-1.4.json.bin    |  168 ++
 .../poetry/some-groups-lock11-1.4.xml.bin     |  112 ++
 .../poetry/some-groups-lock20-1.1.xml.bin     |   14 +
 .../poetry/some-groups-lock20-1.2.json.bin    |   14 +
 .../poetry/some-groups-lock20-1.2.xml.bin     |   14 +
 .../poetry/some-groups-lock20-1.3.json.bin    |   14 +
 .../poetry/some-groups-lock20-1.3.xml.bin     |   14 +
 .../poetry/some-groups-lock20-1.4.json.bin    |   14 +
 .../poetry/some-groups-lock20-1.4.xml.bin     |   14 +
 .../poetry/with-urls-lock10-1.0.xml.bin       |   33 +
 .../poetry/with-urls-lock10-1.1.xml.bin       |   53 +
 .../poetry/with-urls-lock10-1.2.json.bin      |  118 ++
 .../poetry/with-urls-lock10-1.2.xml.bin       |   89 +
 .../poetry/with-urls-lock10-1.3.json.bin      |  150 ++
 .../poetry/with-urls-lock10-1.3.xml.bin       |  103 ++
 .../poetry/with-urls-lock10-1.4.json.bin      |  146 ++
 .../poetry/with-urls-lock10-1.4.xml.bin       |  130 ++
 .../poetry/with-urls-lock11-1.0.xml.bin       |   33 +
 .../poetry/with-urls-lock11-1.1.xml.bin       |   53 +
 .../poetry/with-urls-lock11-1.2.json.bin      |  118 ++
 .../poetry/with-urls-lock11-1.2.xml.bin       |   89 +
 .../poetry/with-urls-lock11-1.3.json.bin      |  158 ++
 .../poetry/with-urls-lock11-1.3.xml.bin       |  105 ++
 .../poetry/with-urls-lock11-1.4.json.bin      |  154 ++
 .../poetry/with-urls-lock11-1.4.xml.bin       |  132 ++
 .../poetry/with-urls-lock20-1.0.xml.bin       |   33 +
 .../poetry/with-urls-lock20-1.1.xml.bin       |   53 +
 .../poetry/with-urls-lock20-1.2.json.bin      |  118 ++
 .../poetry/with-urls-lock20-1.2.xml.bin       |   89 +
 .../poetry/with-urls-lock20-1.3.json.bin      |  170 ++
 .../poetry/with-urls-lock20-1.3.xml.bin       |  111 ++
 .../poetry/with-urls-lock20-1.4.json.bin      |  166 ++
 .../poetry/with-urls-lock20-1.4.xml.bin       |  138 ++
 123 files changed, 19624 insertions(+), 2 deletions(-)
 create mode 100644 tests/_data/infiles/poetry/with-urls/lock10/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/with-urls/lock10/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/with-urls/lock11/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/with-urls/lock11/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/with-urls/lock20/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/with-urls/lock20/pyproject.toml
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin

diff --git a/tests/_data/infiles/poetry/TODO.txt b/tests/_data/infiles/poetry/TODO.txt
index 22b0d3f9..8b541591 100644
--- a/tests/_data/infiles/poetry/TODO.txt
+++ b/tests/_data/infiles/poetry/TODO.txt
@@ -1,2 +1,10 @@
-- local deps
+- local deps (folder, wheel)
 - from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
+
+----
+
+You can specify a package in the following forms:
+    [...]
+    - A file path (../my-package/my-package.whl)
+    - A directory (../my-package/)
+    [...]
diff --git a/tests/_data/infiles/poetry/with-urls/lock10/poetry.lock b/tests/_data/infiles/poetry/with-urls/lock10/poetry.lock
new file mode 100644
index 00000000..e78aa09e
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-urls/lock10/poetry.lock
@@ -0,0 +1,70 @@
+[[package]]
+category = "main"
+description = "Fundamental package for array computing in Python"
+name = "numpy"
+optional = false
+python-versions = ">=3.8"
+version = "1.24.4"
+
+[package.source]
+reference = ""
+type = "url"
+url = "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+[[package]]
+category = "main"
+description = "Python Imaging Library (Fork)"
+name = "Pillow"
+optional = false
+python-versions = ">=3.8"
+version = "10.1.0"
+
+[package.extras]
+docs = ["furo", "olefile", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-removed-in", "sphinx (>=2.4)", "sphinxext-opengraph"]
+tests = ["check-manifest", "coverage", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout"]
+
+[package.source]
+reference = "da59ad000d1405eaecd557175e29083a87d19f7c"
+type = "git"
+url = "https://github.com/python-pillow/Pillow.git"
+[[package]]
+category = "main"
+description = "Python 2 and 3 compatibility utilities"
+name = "six"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+version = "1.16.0"
+
+[package.source]
+reference = "65486e4383f9f411da95937451205d3c7b61b9e1"
+type = "git"
+url = "ssh://git@github.com/benjaminp/six.git"
+[[package]]
+category = "main"
+description = "Cross platform GUI toolkit for Python, \"Phoenix\" version"
+name = "wxPython"
+optional = false
+python-versions = "*"
+version = "4.2.2a1.dev5618+1f82021f"
+
+[package.dependencies]
+pillow = "*"
+six = "*"
+
+[package.dependencies.numpy]
+python = ">=3.0,<3.12"
+version = "*"
+
+[package.source]
+reference = ""
+type = "url"
+url = "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+[metadata]
+content-hash = "b4436d6f975d6f207483913778773f9eee6432c4283394bb277b4100c6a3c1df"
+lock-version = "1.0"
+python-versions = "^3.8"
+
+[metadata.files]
+numpy = []
+Pillow = []
+six = []
+wxPython = []
diff --git a/tests/_data/infiles/poetry/with-urls/lock10/pyproject.toml b/tests/_data/infiles/poetry/with-urls/lock10/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-urls/lock10/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/with-urls/lock11/poetry.lock b/tests/_data/infiles/poetry/with-urls/lock11/poetry.lock
new file mode 100644
index 00000000..e8765f8b
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-urls/lock11/poetry.lock
@@ -0,0 +1,71 @@
+[[package]]
+name = "numpy"
+version = "1.24.4"
+description = "Fundamental package for array computing in Python"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+
+[package.source]
+type = "url"
+url = "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+[[package]]
+name = "Pillow"
+version = "10.1.0"
+description = "Python Imaging Library (Fork)"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+develop = false
+
+[package.extras]
+docs = ["furo", "olefile", "sphinx (>=2.4)", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-removed-in", "sphinxext-opengraph"]
+tests = ["check-manifest", "coverage", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout"]
+
+[package.source]
+type = "git"
+url = "https://github.com/python-pillow/Pillow.git"
+reference = "10.1.0"
+resolved_reference = "da59ad000d1405eaecd557175e29083a87d19f7c"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+develop = false
+
+[package.source]
+type = "git"
+url = "ssh://git@github.com/benjaminp/six.git"
+reference = "1.16.0"
+resolved_reference = "65486e4383f9f411da95937451205d3c7b61b9e1"
+
+[[package]]
+name = "wxPython"
+version = "4.2.2a1.dev5618+1f82021f"
+description = "Cross platform GUI toolkit for Python, \"Phoenix\" version"
+category = "main"
+optional = false
+python-versions = "*"
+
+[package.dependencies]
+numpy = {version = "*", markers = "python_version >= \"3.0\" and python_version < \"3.12\""}
+pillow = "*"
+six = "*"
+
+[package.source]
+type = "url"
+url = "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+[metadata]
+lock-version = "1.1"
+python-versions = "^3.8"
+content-hash = "b4436d6f975d6f207483913778773f9eee6432c4283394bb277b4100c6a3c1df"
+
+[metadata.files]
+numpy = []
+Pillow = []
+six = []
+wxPython = []
diff --git a/tests/_data/infiles/poetry/with-urls/lock11/pyproject.toml b/tests/_data/infiles/poetry/with-urls/lock11/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-urls/lock11/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/with-urls/lock20/poetry.lock b/tests/_data/infiles/poetry/with-urls/lock20/poetry.lock
new file mode 100644
index 00000000..16d83b9c
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-urls/lock20/poetry.lock
@@ -0,0 +1,75 @@
+# This file is automatically @generated by Poetry 1.4.1 and should not be changed by hand.
+
+[[package]]
+name = "numpy"
+version = "1.24.4"
+description = "Fundamental package for array computing in Python"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "numpy-1.24.4.tar.gz", hash = "sha256:80f5e3a4e498641401868df4208b74581206afbee7cf7b8329daae82676d9463"},
+]
+
+[package.source]
+type = "url"
+url = "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+[[package]]
+name = "Pillow"
+version = "10.1.0"
+description = "Python Imaging Library (Fork)"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+files = []
+develop = false
+
+[package.extras]
+docs = ["furo", "olefile", "sphinx (>=2.4)", "sphinx-copybutton", "sphinx-inline-tabs", "sphinx-removed-in", "sphinxext-opengraph"]
+tests = ["check-manifest", "coverage", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout"]
+
+[package.source]
+type = "git"
+url = "https://github.com/python-pillow/Pillow.git"
+reference = "10.1.0"
+resolved_reference = "da59ad000d1405eaecd557175e29083a87d19f7c"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+category = "main"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+files = []
+develop = false
+
+[package.source]
+type = "git"
+url = "ssh://git@github.com/benjaminp/six.git"
+reference = "1.16.0"
+resolved_reference = "65486e4383f9f411da95937451205d3c7b61b9e1"
+
+[[package]]
+name = "wxPython"
+version = "4.2.2a1.dev5618+1f82021f"
+description = "Cross platform GUI toolkit for Python, \"Phoenix\" version"
+category = "main"
+optional = false
+python-versions = "*"
+files = [
+    {file = "wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl", hash = "sha256:6ebb5019c6b999941a6cddd298dff7951d826239d663f6ce698b9547ae72d6b9"},
+]
+
+[package.dependencies]
+numpy = {version = "*", markers = "python_version >= \"3.0\" and python_version < \"3.12\""}
+pillow = "*"
+six = "*"
+
+[package.source]
+type = "url"
+url = "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.8"
+content-hash = "b4436d6f975d6f207483913778773f9eee6432c4283394bb277b4100c6a3c1df"
diff --git a/tests/_data/infiles/poetry/with-urls/lock20/pyproject.toml b/tests/_data/infiles/poetry/with-urls/lock20/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/with-urls/lock20/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/with-urls/pyproject-proto.toml b/tests/_data/infiles/poetry/with-urls/pyproject-proto.toml
index 44879c30..7f442805 100644
--- a/tests/_data/infiles/poetry/with-urls/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/with-urls/pyproject-proto.toml
@@ -5,11 +5,22 @@ description = "packages from direct urls"
 authors = ["Your Name <you@example.com>"]
 
 
-
+# You can specify a package in the following forms:
+#    [...]
+#    - A git url (git+https://github.com/python-poetry/poetry.git)
+#    - A git url with a revision (git+https://github.com/python-poetry/poetry.git#develop)
+#    - A git SSH url (git+ssh://github.com/python-poetry/poetry.git)
+#    - A git SSH url with a revision (git+ssh://github.com/python-poetry/poetry.git#develop)
+#    [...]
+#    - A url (https://example.com/packages/my-package-0.1.0.tar.gz)
 
 
 [tool.poetry.dependencies]
 python = "^3.8"
+wxpython = {url = "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"}
+numpy = {url = "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"}
+pillow = {git = "https://github.com/python-pillow/Pillow.git", rev = "10.1.0"}
+six = {git = "ssh://git@github.com/benjaminp/six.git", rev = "1.16.0"}
 
 
 [build-system]
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
index f33195a4..54b4daf6 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
@@ -6,42 +6,112 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
       <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
       <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
       <name>python-dateutil</name>
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
index 9278c3db..3ac51276 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
@@ -3,6 +3,18 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "purl": "pkg:pypi/arrow@1.3.0",
       "type": "library",
@@ -11,6 +23,18 @@
     {
       "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
+        }
+      ],
       "name": "ddt",
       "purl": "pkg:pypi/ddt@1.7.0",
       "type": "library",
@@ -19,6 +43,18 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "purl": "pkg:pypi/isoduration@20.11.0",
       "type": "library",
@@ -27,6 +63,18 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "purl": "pkg:pypi/python-dateutil@2.8.2",
       "type": "library",
@@ -35,6 +83,18 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "purl": "pkg:pypi/six@1.16.0",
       "type": "library",
@@ -43,6 +103,18 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "purl": "pkg:pypi/toml@0.10.2",
       "type": "library",
@@ -51,6 +123,18 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
index 7c642cc1..b01bc630 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
@@ -26,42 +26,112 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="ddt@1.7.0">
       <name>ddt</name>
       <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
       <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
       <name>python-dateutil</name>
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
index 204fc98a..265694c3 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
+        }
+      ],
       "name": "ddt",
       "properties": [
         {
@@ -31,6 +79,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -49,6 +121,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -63,6 +159,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -77,6 +197,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -91,6 +235,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
index 1ed74891..c740b5b6 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
@@ -26,6 +26,22 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -35,6 +51,22 @@
       <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
       <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -44,6 +76,22 @@
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
         <property name="cdx:poetry:group">groupB</property>
@@ -54,6 +102,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -63,6 +127,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -72,6 +152,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -81,6 +177,22 @@
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
index 9835d156..18d1e493 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "ddt@1.7.0",
       "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
+        }
+      ],
       "name": "ddt",
       "properties": [
         {
@@ -31,6 +79,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -49,6 +121,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -63,6 +159,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -77,6 +197,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -91,6 +235,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
index c3f60318..039c2b63 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
@@ -53,6 +53,22 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -62,6 +78,22 @@
       <version>1.7.0</version>
       <description>Data-Driven/Decorated Tests</description>
       <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -71,6 +103,22 @@
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
         <property name="cdx:poetry:group">groupB</property>
@@ -81,6 +129,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -90,6 +154,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -99,6 +179,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -108,6 +204,22 @@
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
index 2f80e75e..54b4daf6 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
@@ -9,9 +9,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -23,9 +25,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -37,9 +41,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -51,9 +57,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -65,9 +73,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -79,9 +89,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -93,9 +105,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
index 3ffad094..3ac51276 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
@@ -5,10 +5,12 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
         }
@@ -23,10 +25,12 @@
       "description": "Data-Driven/Decorated Tests",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
         }
@@ -41,10 +45,12 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
         }
@@ -59,10 +65,12 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
         }
@@ -77,10 +85,12 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
         }
@@ -95,10 +105,12 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
         }
@@ -113,10 +125,12 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
         }
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
index 3aa1604d..b01bc630 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
@@ -29,9 +29,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -43,9 +45,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -57,9 +61,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -71,9 +77,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -85,9 +93,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -99,9 +109,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -113,9 +125,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
index d266ffc7..3a007187 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -35,6 +37,7 @@
       "description": "Data-Driven/Decorated Tests",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -45,6 +48,7 @@
           "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +145,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +156,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +177,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +188,7 @@
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -203,6 +215,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -213,6 +226,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
index 341cfafb..f6cb2a9c 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
@@ -29,12 +29,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -49,12 +51,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
           </hashes>
@@ -72,12 +76,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -95,12 +101,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -115,12 +123,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -135,12 +145,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -158,12 +170,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
index 11f924ad..1001840a 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -35,6 +37,7 @@
       "description": "Data-Driven/Decorated Tests",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -45,6 +48,7 @@
           "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +145,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +156,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +177,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +188,7 @@
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -203,6 +215,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -213,6 +226,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
index 428b82db..4d1549fd 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
@@ -56,12 +56,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -76,12 +78,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
           </hashes>
@@ -99,12 +103,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -122,12 +128,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -142,12 +150,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -162,12 +172,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -185,12 +197,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin
index 3a5f5dfc..db75f11e 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin
@@ -12,6 +12,16 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
@@ -24,18 +34,48 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
index cd9b51a5..04ad688b 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
@@ -11,6 +11,18 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -27,6 +39,18 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "purl": "pkg:pypi/python-dateutil@2.8.2",
       "type": "library",
@@ -35,6 +59,18 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "purl": "pkg:pypi/six@1.16.0",
       "type": "library",
@@ -43,6 +79,18 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "purl": "pkg:pypi/toml@0.10.2",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
index 02190713..9ffe1108 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
@@ -32,6 +32,16 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
@@ -44,18 +54,48 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
index 77c0ce55..dbdf1ba4 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
@@ -17,6 +17,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -45,6 +69,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -59,6 +107,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -73,6 +145,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
index df4f2a02..aa91453c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
@@ -35,6 +35,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -53,6 +69,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -62,6 +94,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -71,6 +119,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
index 2c06f303..e4280ba1 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
@@ -17,6 +17,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -45,6 +69,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -59,6 +107,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -73,6 +145,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
index 68ae7254..ca716ae2 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
@@ -62,6 +62,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -80,6 +96,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -89,6 +121,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -98,6 +146,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin
index 3a5f5dfc..49274208 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin
@@ -6,42 +6,112 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
       <name>python-dateutil</name>
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
index cd9b51a5..926c010c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
@@ -3,6 +3,18 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "purl": "pkg:pypi/arrow@1.3.0",
       "type": "library",
@@ -11,6 +23,18 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -19,6 +43,18 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "purl": "pkg:pypi/isoduration@20.11.0",
       "type": "library",
@@ -27,6 +63,18 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "purl": "pkg:pypi/python-dateutil@2.8.2",
       "type": "library",
@@ -35,6 +83,18 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "purl": "pkg:pypi/six@1.16.0",
       "type": "library",
@@ -43,6 +103,18 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "purl": "pkg:pypi/toml@0.10.2",
       "type": "library",
@@ -51,6 +123,18 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
index 02190713..1ab167fb 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
@@ -26,42 +26,112 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
       <name>python-dateutil</name>
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
index 77c0ce55..320820ff 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -31,6 +79,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -45,6 +117,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -59,6 +155,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -73,6 +193,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -87,6 +231,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
index df4f2a02..88907e2e 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
@@ -26,6 +26,22 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -35,6 +51,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -44,6 +76,22 @@
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -53,6 +101,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -62,6 +126,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -71,6 +151,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -80,6 +176,22 @@
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
index 2c06f303..8388725a 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -31,6 +79,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -45,6 +117,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -59,6 +155,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -73,6 +193,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -87,6 +231,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
index 68ae7254..d21af018 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
@@ -53,6 +53,22 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -62,6 +78,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -71,6 +103,22 @@
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -80,6 +128,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -89,6 +153,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -98,6 +178,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -107,6 +203,22 @@
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin
index 0516f8eb..49274208 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin
@@ -9,9 +9,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -23,9 +25,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -37,9 +41,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -51,9 +57,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -65,9 +73,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -79,9 +89,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -93,9 +105,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
index 92edb9a3..926c010c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
@@ -5,10 +5,12 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
         }
@@ -23,10 +25,12 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
         }
@@ -41,10 +45,12 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
         }
@@ -59,10 +65,12 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
         }
@@ -77,10 +85,12 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
         }
@@ -95,10 +105,12 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
         }
@@ -113,10 +125,12 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
         }
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
index fde5b2e0..1ab167fb 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
@@ -29,9 +29,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -43,9 +45,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -57,9 +61,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -71,9 +77,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -85,9 +93,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -99,9 +109,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -113,9 +125,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
index 3cc6bb1f..a8d31f1a 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -35,6 +37,7 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -45,6 +48,7 @@
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +145,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +156,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +177,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +188,7 @@
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -203,6 +215,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -213,6 +226,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
index 651e12c1..28a4b061 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
@@ -29,12 +29,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -49,12 +51,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
           </hashes>
@@ -72,12 +76,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -95,12 +101,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -115,12 +123,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -135,12 +145,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -158,12 +170,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
index c9334ec2..7707730a 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -35,6 +37,7 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -45,6 +48,7 @@
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +145,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +156,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +177,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +188,7 @@
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -203,6 +215,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -213,6 +226,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
index ecb754ed..1c1b3501 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
@@ -56,12 +56,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -76,12 +78,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
           </hashes>
@@ -99,12 +103,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -122,12 +128,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -142,12 +150,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -162,12 +172,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -185,12 +197,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
index fc1020b9..79efaaca 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
@@ -6,12 +6,32 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
index 951eb36d..a2851e25 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
@@ -3,6 +3,18 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -11,6 +23,18 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "purl": "pkg:pypi/toml@0.10.2",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
index 8feee35a..d5a6d11c 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
@@ -26,12 +26,32 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
index abeb3327..0fd47c7e 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
index 4cf2d91e..10f12101 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
@@ -26,6 +26,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -35,6 +51,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
index 1b271bcb..bbb42f12 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
index 1e207d0c..ade38990 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
@@ -53,6 +53,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -62,6 +78,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
index f9a40645..4ee6c7c7 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
@@ -6,54 +6,416 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="importlib-metadata@6.8.0">
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
       <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="jax@0.4.20">
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
       <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="ml-dtypes@0.3.1">
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
       <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="numpy@1.26.1">
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
       <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="opt-einsum@3.3.0">
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
       <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="scipy@1.11.3">
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
       <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
index 66fdf656..20fd312a 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
@@ -3,6 +3,18 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -11,6 +23,18 @@
     {
       "bom-ref": "importlib-metadata@6.8.0",
       "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
       "name": "importlib-metadata",
       "purl": "pkg:pypi/importlib-metadata@6.8.0",
       "type": "library",
@@ -19,6 +43,18 @@
     {
       "bom-ref": "jax@0.4.20",
       "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
       "name": "jax",
       "purl": "pkg:pypi/jax@0.4.20",
       "type": "library",
@@ -27,6 +63,93 @@
     {
       "bom-ref": "ml-dtypes@0.3.1",
       "description": "",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
       "name": "ml-dtypes",
       "purl": "pkg:pypi/ml-dtypes@0.3.1",
       "type": "library",
@@ -35,6 +158,168 @@
     {
       "bom-ref": "numpy@1.26.1",
       "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
       "name": "numpy",
       "purl": "pkg:pypi/numpy@1.26.1",
       "type": "library",
@@ -43,6 +328,18 @@
     {
       "bom-ref": "opt-einsum@3.3.0",
       "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
       "name": "opt-einsum",
       "purl": "pkg:pypi/opt-einsum@3.3.0",
       "type": "library",
@@ -51,6 +348,133 @@
     {
       "bom-ref": "scipy@1.11.3",
       "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
       "name": "scipy",
       "purl": "pkg:pypi/scipy@1.11.3",
       "type": "library",
@@ -59,6 +483,18 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "purl": "pkg:pypi/toml@0.10.2",
       "type": "library",
@@ -67,6 +503,18 @@
     {
       "bom-ref": "zipp@3.17.0",
       "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
       "name": "zipp",
       "purl": "pkg:pypi/zipp@3.17.0",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
index 87ec2d77..1e15bbdd 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
@@ -26,54 +26,416 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="importlib-metadata@6.8.0">
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
       <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="jax@0.4.20">
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
       <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="ml-dtypes@0.3.1">
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
       <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="numpy@1.26.1">
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
       <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="opt-einsum@3.3.0">
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
       <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="scipy@1.11.3">
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
       <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
index 620ca9d3..da65bf8b 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "importlib-metadata@6.8.0",
       "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
       "name": "importlib-metadata",
       "properties": [
         {
@@ -31,6 +79,30 @@
     {
       "bom-ref": "jax@0.4.20",
       "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
       "name": "jax",
       "properties": [
         {
@@ -45,6 +117,195 @@
     {
       "bom-ref": "ml-dtypes@0.3.1",
       "description": "",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
       "name": "ml-dtypes",
       "properties": [
         {
@@ -59,6 +320,360 @@
     {
       "bom-ref": "numpy@1.26.1",
       "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
       "name": "numpy",
       "properties": [
         {
@@ -73,6 +688,30 @@
     {
       "bom-ref": "opt-einsum@3.3.0",
       "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
       "name": "opt-einsum",
       "properties": [
         {
@@ -87,6 +726,283 @@
     {
       "bom-ref": "scipy@1.11.3",
       "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
       "name": "scipy",
       "properties": [
         {
@@ -101,6 +1017,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -115,6 +1055,30 @@
     {
       "bom-ref": "zipp@3.17.0",
       "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
       "name": "zipp",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
index 595fc2f9..ac30ef5f 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
@@ -26,6 +26,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -35,6 +51,22 @@
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
       <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -44,6 +76,22 @@
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
       <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -53,6 +101,127 @@
       <version>0.3.1</version>
       <description/>
       <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -62,6 +231,232 @@
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
       <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -71,6 +466,22 @@
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
       <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -80,6 +491,183 @@
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
       <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -89,6 +677,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -98,6 +702,22 @@
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
index 062ea86c..15cfd906 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "importlib-metadata@6.8.0",
       "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
       "name": "importlib-metadata",
       "properties": [
         {
@@ -31,6 +79,30 @@
     {
       "bom-ref": "jax@0.4.20",
       "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
       "name": "jax",
       "properties": [
         {
@@ -45,6 +117,195 @@
     {
       "bom-ref": "ml-dtypes@0.3.1",
       "description": "",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
       "name": "ml-dtypes",
       "properties": [
         {
@@ -59,6 +320,360 @@
     {
       "bom-ref": "numpy@1.26.1",
       "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
       "name": "numpy",
       "properties": [
         {
@@ -73,6 +688,30 @@
     {
       "bom-ref": "opt-einsum@3.3.0",
       "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
       "name": "opt-einsum",
       "properties": [
         {
@@ -87,6 +726,283 @@
     {
       "bom-ref": "scipy@1.11.3",
       "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
       "name": "scipy",
       "properties": [
         {
@@ -101,6 +1017,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -115,6 +1055,30 @@
     {
       "bom-ref": "zipp@3.17.0",
       "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
       "name": "zipp",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
index ec802166..36ddfbeb 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
@@ -53,6 +53,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -62,6 +78,22 @@
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
       <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -71,6 +103,22 @@
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
       <purl>pkg:pypi/jax@0.4.20</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -80,6 +128,127 @@
       <version>0.3.1</version>
       <description/>
       <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -89,6 +258,232 @@
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
       <purl>pkg:pypi/numpy@1.26.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -98,6 +493,22 @@
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
       <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -107,6 +518,183 @@
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
       <purl>pkg:pypi/scipy@1.11.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -116,6 +704,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -125,6 +729,22 @@
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
index 9448b225..4ee6c7c7 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
@@ -9,9 +9,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -23,9 +25,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -37,9 +41,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -51,54 +57,71 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -110,99 +133,131 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -214,9 +269,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -228,78 +285,103 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -311,9 +393,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -325,9 +409,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
index a89b75b6..20fd312a 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
@@ -5,10 +5,12 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
         }
@@ -23,10 +25,12 @@
       "description": "Read metadata from Python packages",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
         }
@@ -41,10 +45,12 @@
       "description": "Differentiate, compile, and transform Numpy code.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
         }
@@ -59,70 +65,87 @@
       "description": "",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
         }
@@ -137,130 +160,162 @@
       "description": "Fundamental package for array computing in Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
         }
@@ -275,10 +330,12 @@
       "description": "Optimizing numpys einsum function",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
         }
@@ -293,102 +350,127 @@
       "description": "Fundamental algorithms for scientific computing in Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
         }
@@ -403,10 +485,12 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
         }
@@ -421,10 +505,12 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
         }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
index 2d002503..1e15bbdd 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
@@ -29,9 +29,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -43,9 +45,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -57,9 +61,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -71,54 +77,71 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -130,99 +153,131 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -234,9 +289,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -248,78 +305,103 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -331,9 +413,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -345,9 +429,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
index 51564a08..f62eeffb 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
@@ -5,6 +5,7 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -41,6 +43,7 @@
       "description": "Read metadata from Python packages",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -51,6 +54,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Differentiate, compile, and transform Numpy code.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -127,6 +135,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +146,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +157,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -157,6 +168,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +179,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +190,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -187,6 +201,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -197,6 +212,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -207,6 +223,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -217,6 +234,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -227,6 +245,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -237,6 +256,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -247,6 +267,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -257,6 +278,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -267,6 +289,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -287,6 +310,7 @@
       "description": "Fundamental package for array computing in Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -297,6 +321,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -307,6 +332,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -317,6 +343,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -327,6 +354,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -337,6 +365,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -347,6 +376,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -357,6 +387,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -367,6 +398,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -377,6 +409,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -387,6 +420,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -397,6 +431,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -407,6 +442,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -417,6 +453,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -427,6 +464,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -437,6 +475,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -447,6 +486,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -457,6 +497,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -467,6 +508,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -477,6 +519,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -487,6 +530,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -497,6 +541,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -507,6 +552,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -517,6 +563,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -527,6 +574,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -537,6 +585,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -547,6 +596,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -557,6 +607,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -567,6 +618,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -577,6 +629,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -587,6 +640,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -597,6 +651,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -617,6 +672,7 @@
       "description": "Optimizing numpys einsum function",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -627,6 +683,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -647,6 +704,7 @@
       "description": "Fundamental algorithms for scientific computing in Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -657,6 +715,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -667,6 +726,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -677,6 +737,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -687,6 +748,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -697,6 +759,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -707,6 +770,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -717,6 +781,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -727,6 +792,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -737,6 +803,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -747,6 +814,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -757,6 +825,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -767,6 +836,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -777,6 +847,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -787,6 +858,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -797,6 +869,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -807,6 +880,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -817,6 +891,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -827,6 +902,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -837,6 +913,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -847,6 +924,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -857,6 +935,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -867,6 +946,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -877,6 +957,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -887,6 +968,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -907,6 +989,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -917,6 +1000,7 @@
           "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -943,6 +1027,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -953,6 +1038,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
index 62ca3eba..b435f642 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
@@ -29,12 +29,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
           </hashes>
@@ -52,12 +54,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
           </hashes>
@@ -72,12 +76,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
           </hashes>
@@ -95,102 +101,119 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
           </hashes>
@@ -205,192 +228,224 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
           </hashes>
@@ -405,12 +460,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
           </hashes>
@@ -425,150 +482,175 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
           </hashes>
@@ -583,12 +665,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -606,12 +690,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
index cbc23349..716cb60c 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
@@ -5,6 +5,7 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -41,6 +43,7 @@
       "description": "Read metadata from Python packages",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -51,6 +54,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Differentiate, compile, and transform Numpy code.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -127,6 +135,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +146,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +157,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -157,6 +168,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +179,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +190,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -187,6 +201,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -197,6 +212,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -207,6 +223,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -217,6 +234,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -227,6 +245,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -237,6 +256,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -247,6 +267,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -257,6 +278,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -267,6 +289,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -287,6 +310,7 @@
       "description": "Fundamental package for array computing in Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -297,6 +321,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -307,6 +332,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -317,6 +343,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -327,6 +354,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -337,6 +365,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -347,6 +376,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -357,6 +387,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -367,6 +398,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -377,6 +409,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -387,6 +420,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -397,6 +431,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -407,6 +442,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -417,6 +453,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -427,6 +464,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -437,6 +475,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -447,6 +486,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -457,6 +497,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -467,6 +508,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -477,6 +519,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -487,6 +530,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -497,6 +541,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -507,6 +552,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -517,6 +563,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -527,6 +574,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -537,6 +585,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -547,6 +596,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -557,6 +607,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -567,6 +618,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -577,6 +629,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -587,6 +640,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -597,6 +651,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -617,6 +672,7 @@
       "description": "Optimizing numpys einsum function",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -627,6 +683,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -647,6 +704,7 @@
       "description": "Fundamental algorithms for scientific computing in Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -657,6 +715,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -667,6 +726,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -677,6 +737,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -687,6 +748,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -697,6 +759,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -707,6 +770,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -717,6 +781,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -727,6 +792,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -737,6 +803,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -747,6 +814,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -757,6 +825,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -767,6 +836,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -777,6 +847,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -787,6 +858,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -797,6 +869,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -807,6 +880,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -817,6 +891,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -827,6 +902,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -837,6 +913,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -847,6 +924,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -857,6 +935,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -867,6 +946,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -877,6 +957,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -887,6 +968,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -907,6 +989,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -917,6 +1000,7 @@
           "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -943,6 +1027,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -953,6 +1038,7 @@
           "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
index 6de7012b..bc668092 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
@@ -56,12 +56,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
           </hashes>
@@ -79,12 +81,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
           </hashes>
@@ -99,12 +103,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
           </hashes>
@@ -122,102 +128,119 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
           </hashes>
@@ -232,192 +255,224 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
           </hashes>
@@ -432,12 +487,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
           </hashes>
@@ -452,150 +509,175 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
           </hashes>
@@ -610,12 +692,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -633,12 +717,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin
index 24359e43..de9f1df8 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin
@@ -9,9 +9,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
index f6b447f0..763b1c13 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
@@ -5,10 +5,12 @@
       "description": "\ud83d\udc2b  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz"
         }
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
index 905be3e7..0909fbed 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
@@ -29,9 +29,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
index c8dc23bb..96787385 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
@@ -5,6 +5,7 @@
       "description": "\ud83d\udc2b  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
index 0d4447d0..354f0332 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
@@ -29,12 +29,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
index 97226745..89e08e07 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
@@ -5,6 +5,7 @@
       "description": "\ud83d\udc2b  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
index c8a799ff..876ea47c 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
@@ -56,12 +56,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin
index 52e9023b..4a279cc5 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin
@@ -7,6 +7,16 @@
       <description>Better dates &amp; times for Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="attrs@23.1.0">
       <name>attrs</name>
@@ -14,6 +24,16 @@
       <description>Classes Without Boilerplate</description>
       <scope>optional</scope>
       <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="boolean.py@4.0">
       <name>boolean.py</name>
@@ -42,6 +62,16 @@
       <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
       <scope>optional</scope>
       <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="idna@3.4">
       <name>idna</name>
@@ -49,6 +79,16 @@
       <description>Internationalized Domain Names in Applications (IDNA)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="importlib-resources@6.1.1">
       <name>importlib-resources</name>
@@ -56,6 +96,16 @@
       <description>Read resources from Python packages</description>
       <scope>optional</scope>
       <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
@@ -63,6 +113,16 @@
       <description>Operations with ISO 8601 durations</description>
       <scope>optional</scope>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="jsonpointer@2.4">
       <name>jsonpointer</name>
@@ -70,6 +130,16 @@
       <description>Identify specific nodes in a JSON document (RFC 6901)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="jsonschema@4.19.2">
       <name>jsonschema</name>
@@ -84,6 +154,16 @@
       <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="license-expression@30.1.1">
       <name>license-expression</name>
@@ -112,6 +192,16 @@
       <description>Resolve a name to an object.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="py-serializable@0.15.0">
       <name>py-serializable</name>
@@ -126,6 +216,16 @@
       <description>Extensions to the standard Python datetime module</description>
       <scope>optional</scope>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="referencing@0.30.2">
       <name>referencing</name>
@@ -133,6 +233,16 @@
       <description>JSON Referencing + Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="rfc3339-validator@0.1.4">
       <name>rfc3339-validator</name>
@@ -140,6 +250,16 @@
       <description>A pure python RFC3339 validator</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="rfc3987@1.3.8">
       <name>rfc3987</name>
@@ -147,6 +267,16 @@
       <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="rpds-py@0.12.0">
       <name>rpds-py</name>
@@ -154,6 +284,404 @@
       <description>Python bindings to Rust's persistent data structures (rpds)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
@@ -161,6 +689,16 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <scope>optional</scope>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="sortedcontainers@2.4.0">
       <name>sortedcontainers</name>
@@ -175,6 +713,16 @@
       <description>Typing stubs for python-dateutil</description>
       <scope>optional</scope>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="uri-template@1.3.0">
       <name>uri-template</name>
@@ -182,6 +730,16 @@
       <description>RFC 6570 URI Template Processor</description>
       <scope>optional</scope>
       <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="webcolors@1.13">
       <name>webcolors</name>
@@ -189,6 +747,16 @@
       <description>A library for working with the color formats defined by HTML and CSS.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
       <name>zipp</name>
@@ -196,6 +764,16 @@
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <scope>optional</scope>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
index c1beeb3b..c3bb368d 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
@@ -3,6 +3,18 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "purl": "pkg:pypi/arrow@1.3.0",
       "scope": "optional",
@@ -12,6 +24,18 @@
     {
       "bom-ref": "attrs@23.1.0",
       "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
       "name": "attrs",
       "purl": "pkg:pypi/attrs@23.1.0",
       "scope": "optional",
@@ -48,6 +72,18 @@
     {
       "bom-ref": "fqdn@1.5.1",
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
       "name": "fqdn",
       "purl": "pkg:pypi/fqdn@1.5.1",
       "scope": "optional",
@@ -57,6 +93,18 @@
     {
       "bom-ref": "idna@3.4",
       "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
       "name": "idna",
       "purl": "pkg:pypi/idna@3.4",
       "scope": "optional",
@@ -66,6 +114,18 @@
     {
       "bom-ref": "importlib-resources@6.1.1",
       "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
       "name": "importlib-resources",
       "purl": "pkg:pypi/importlib-resources@6.1.1",
       "scope": "optional",
@@ -75,6 +135,18 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "purl": "pkg:pypi/isoduration@20.11.0",
       "scope": "optional",
@@ -84,6 +156,18 @@
     {
       "bom-ref": "jsonpointer@2.4",
       "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
       "name": "jsonpointer",
       "purl": "pkg:pypi/jsonpointer@2.4",
       "scope": "optional",
@@ -102,6 +186,18 @@
     {
       "bom-ref": "jsonschema-specifications@2023.7.1",
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
       "name": "jsonschema-specifications",
       "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
       "scope": "optional",
@@ -138,6 +234,18 @@
     {
       "bom-ref": "pkgutil-resolve-name@1.3.10",
       "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
       "name": "pkgutil-resolve-name",
       "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
       "scope": "optional",
@@ -156,6 +264,18 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "purl": "pkg:pypi/python-dateutil@2.8.2",
       "scope": "optional",
@@ -165,6 +285,18 @@
     {
       "bom-ref": "referencing@0.30.2",
       "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
       "name": "referencing",
       "purl": "pkg:pypi/referencing@0.30.2",
       "scope": "optional",
@@ -174,6 +306,18 @@
     {
       "bom-ref": "rfc3339-validator@0.1.4",
       "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
       "name": "rfc3339-validator",
       "purl": "pkg:pypi/rfc3339-validator@0.1.4",
       "scope": "optional",
@@ -183,6 +327,18 @@
     {
       "bom-ref": "rfc3987@1.3.8",
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
       "name": "rfc3987",
       "purl": "pkg:pypi/rfc3987@1.3.8",
       "scope": "optional",
@@ -192,6 +348,503 @@
     {
       "bom-ref": "rpds-py@0.12.0",
       "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
       "name": "rpds-py",
       "purl": "pkg:pypi/rpds-py@0.12.0",
       "scope": "optional",
@@ -201,6 +854,18 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "purl": "pkg:pypi/six@1.16.0",
       "scope": "optional",
@@ -219,6 +884,18 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
       "scope": "optional",
@@ -228,6 +905,18 @@
     {
       "bom-ref": "uri-template@1.3.0",
       "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
       "name": "uri-template",
       "purl": "pkg:pypi/uri-template@1.3.0",
       "scope": "optional",
@@ -237,6 +926,18 @@
     {
       "bom-ref": "webcolors@1.13",
       "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
       "name": "webcolors",
       "purl": "pkg:pypi/webcolors@1.13",
       "scope": "optional",
@@ -246,6 +947,18 @@
     {
       "bom-ref": "zipp@3.17.0",
       "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
       "name": "zipp",
       "purl": "pkg:pypi/zipp@3.17.0",
       "scope": "optional",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
index 1b549fa3..719f4161 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
@@ -27,6 +27,16 @@
       <description>Better dates &amp; times for Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="attrs@23.1.0">
       <name>attrs</name>
@@ -34,6 +44,16 @@
       <description>Classes Without Boilerplate</description>
       <scope>optional</scope>
       <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="boolean.py@4.0">
       <name>boolean.py</name>
@@ -62,6 +82,16 @@
       <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
       <scope>optional</scope>
       <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="idna@3.4">
       <name>idna</name>
@@ -69,6 +99,16 @@
       <description>Internationalized Domain Names in Applications (IDNA)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="importlib-resources@6.1.1">
       <name>importlib-resources</name>
@@ -76,6 +116,16 @@
       <description>Read resources from Python packages</description>
       <scope>optional</scope>
       <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
@@ -83,6 +133,16 @@
       <description>Operations with ISO 8601 durations</description>
       <scope>optional</scope>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="jsonpointer@2.4">
       <name>jsonpointer</name>
@@ -90,6 +150,16 @@
       <description>Identify specific nodes in a JSON document (RFC 6901)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="jsonschema@4.19.2">
       <name>jsonschema</name>
@@ -104,6 +174,16 @@
       <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="license-expression@30.1.1">
       <name>license-expression</name>
@@ -132,6 +212,16 @@
       <description>Resolve a name to an object.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="py-serializable@0.15.0">
       <name>py-serializable</name>
@@ -146,6 +236,16 @@
       <description>Extensions to the standard Python datetime module</description>
       <scope>optional</scope>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="referencing@0.30.2">
       <name>referencing</name>
@@ -153,6 +253,16 @@
       <description>JSON Referencing + Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="rfc3339-validator@0.1.4">
       <name>rfc3339-validator</name>
@@ -160,6 +270,16 @@
       <description>A pure python RFC3339 validator</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="rfc3987@1.3.8">
       <name>rfc3987</name>
@@ -167,6 +287,16 @@
       <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="rpds-py@0.12.0">
       <name>rpds-py</name>
@@ -174,6 +304,404 @@
       <description>Python bindings to Rust's persistent data structures (rpds)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
@@ -181,6 +709,16 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <scope>optional</scope>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="sortedcontainers@2.4.0">
       <name>sortedcontainers</name>
@@ -195,6 +733,16 @@
       <description>Typing stubs for python-dateutil</description>
       <scope>optional</scope>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="uri-template@1.3.0">
       <name>uri-template</name>
@@ -202,6 +750,16 @@
       <description>RFC 6570 URI Template Processor</description>
       <scope>optional</scope>
       <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="webcolors@1.13">
       <name>webcolors</name>
@@ -209,6 +767,16 @@
       <description>A library for working with the color formats defined by HTML and CSS.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="zipp@3.17.0">
       <name>zipp</name>
@@ -216,6 +784,16 @@
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <scope>optional</scope>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
index 9ec58d64..063423e3 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -18,6 +42,30 @@
     {
       "bom-ref": "attrs@23.1.0",
       "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
       "name": "attrs",
       "properties": [
         {
@@ -86,6 +134,30 @@
     {
       "bom-ref": "fqdn@1.5.1",
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
       "name": "fqdn",
       "properties": [
         {
@@ -101,6 +173,30 @@
     {
       "bom-ref": "idna@3.4",
       "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
       "name": "idna",
       "properties": [
         {
@@ -116,6 +212,30 @@
     {
       "bom-ref": "importlib-resources@6.1.1",
       "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
       "name": "importlib-resources",
       "properties": [
         {
@@ -131,6 +251,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -146,6 +290,30 @@
     {
       "bom-ref": "jsonpointer@2.4",
       "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
       "name": "jsonpointer",
       "properties": [
         {
@@ -180,6 +348,30 @@
     {
       "bom-ref": "jsonschema-specifications@2023.7.1",
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
       "name": "jsonschema-specifications",
       "properties": [
         {
@@ -240,6 +432,30 @@
     {
       "bom-ref": "pkgutil-resolve-name@1.3.10",
       "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
       "name": "pkgutil-resolve-name",
       "properties": [
         {
@@ -270,6 +486,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -285,6 +525,30 @@
     {
       "bom-ref": "referencing@0.30.2",
       "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
       "name": "referencing",
       "properties": [
         {
@@ -300,6 +564,30 @@
     {
       "bom-ref": "rfc3339-validator@0.1.4",
       "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
       "name": "rfc3339-validator",
       "properties": [
         {
@@ -315,6 +603,30 @@
     {
       "bom-ref": "rfc3987@1.3.8",
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
       "name": "rfc3987",
       "properties": [
         {
@@ -330,6 +642,1097 @@
     {
       "bom-ref": "rpds-py@0.12.0",
       "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
       "name": "rpds-py",
       "properties": [
         {
@@ -345,6 +1748,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -375,6 +1802,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
@@ -390,6 +1841,30 @@
     {
       "bom-ref": "uri-template@1.3.0",
       "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
       "name": "uri-template",
       "properties": [
         {
@@ -405,6 +1880,30 @@
     {
       "bom-ref": "webcolors@1.13",
       "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
       "name": "webcolors",
       "properties": [
         {
@@ -420,6 +1919,30 @@
     {
       "bom-ref": "zipp@3.17.0",
       "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
       "name": "zipp",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
index 13e54d4a..0bfac609 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
@@ -30,6 +30,22 @@
       <description>Better dates &amp; times for Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -40,6 +56,22 @@
       <description>Classes Without Boilerplate</description>
       <scope>optional</scope>
       <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -82,6 +114,22 @@
       <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
       <scope>optional</scope>
       <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -92,6 +140,22 @@
       <description>Internationalized Domain Names in Applications (IDNA)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -102,6 +166,22 @@
       <description>Read resources from Python packages</description>
       <scope>optional</scope>
       <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -112,6 +192,22 @@
       <description>Operations with ISO 8601 durations</description>
       <scope>optional</scope>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -122,6 +218,22 @@
       <description>Identify specific nodes in a JSON document (RFC 6901)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -143,6 +255,22 @@
       <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -183,6 +311,22 @@
       <description>Resolve a name to an object.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -203,6 +347,22 @@
       <description>Extensions to the standard Python datetime module</description>
       <scope>optional</scope>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -213,6 +373,22 @@
       <description>JSON Referencing + Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -223,6 +399,22 @@
       <description>A pure python RFC3339 validator</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -233,6 +425,22 @@
       <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -243,6 +451,701 @@
       <description>Python bindings to Rust's persistent data structures (rpds)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -253,6 +1156,22 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <scope>optional</scope>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -273,6 +1192,22 @@
       <description>Typing stubs for python-dateutil</description>
       <scope>optional</scope>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -283,6 +1218,22 @@
       <description>RFC 6570 URI Template Processor</description>
       <scope>optional</scope>
       <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -293,6 +1244,22 @@
       <description>A library for working with the color formats defined by HTML and CSS.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -303,6 +1270,22 @@
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <scope>optional</scope>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
index ca7ce7df..ac64968a 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -18,6 +42,30 @@
     {
       "bom-ref": "attrs@23.1.0",
       "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
       "name": "attrs",
       "properties": [
         {
@@ -86,6 +134,30 @@
     {
       "bom-ref": "fqdn@1.5.1",
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
       "name": "fqdn",
       "properties": [
         {
@@ -101,6 +173,30 @@
     {
       "bom-ref": "idna@3.4",
       "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
       "name": "idna",
       "properties": [
         {
@@ -116,6 +212,30 @@
     {
       "bom-ref": "importlib-resources@6.1.1",
       "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
       "name": "importlib-resources",
       "properties": [
         {
@@ -131,6 +251,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -146,6 +290,30 @@
     {
       "bom-ref": "jsonpointer@2.4",
       "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
       "name": "jsonpointer",
       "properties": [
         {
@@ -180,6 +348,30 @@
     {
       "bom-ref": "jsonschema-specifications@2023.7.1",
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
       "name": "jsonschema-specifications",
       "properties": [
         {
@@ -240,6 +432,30 @@
     {
       "bom-ref": "pkgutil-resolve-name@1.3.10",
       "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
       "name": "pkgutil-resolve-name",
       "properties": [
         {
@@ -270,6 +486,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -285,6 +525,30 @@
     {
       "bom-ref": "referencing@0.30.2",
       "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
       "name": "referencing",
       "properties": [
         {
@@ -300,6 +564,30 @@
     {
       "bom-ref": "rfc3339-validator@0.1.4",
       "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
       "name": "rfc3339-validator",
       "properties": [
         {
@@ -315,6 +603,30 @@
     {
       "bom-ref": "rfc3987@1.3.8",
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
       "name": "rfc3987",
       "properties": [
         {
@@ -330,6 +642,1097 @@
     {
       "bom-ref": "rpds-py@0.12.0",
       "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
       "name": "rpds-py",
       "properties": [
         {
@@ -345,6 +1748,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -375,6 +1802,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
@@ -390,6 +1841,30 @@
     {
       "bom-ref": "uri-template@1.3.0",
       "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
       "name": "uri-template",
       "properties": [
         {
@@ -405,6 +1880,30 @@
     {
       "bom-ref": "webcolors@1.13",
       "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
       "name": "webcolors",
       "properties": [
         {
@@ -420,6 +1919,30 @@
     {
       "bom-ref": "zipp@3.17.0",
       "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
       "name": "zipp",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
index a9715029..a3ab677b 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
@@ -57,6 +57,22 @@
       <description>Better dates &amp; times for Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -67,6 +83,22 @@
       <description>Classes Without Boilerplate</description>
       <scope>optional</scope>
       <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -109,6 +141,22 @@
       <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
       <scope>optional</scope>
       <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -119,6 +167,22 @@
       <description>Internationalized Domain Names in Applications (IDNA)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -129,6 +193,22 @@
       <description>Read resources from Python packages</description>
       <scope>optional</scope>
       <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -139,6 +219,22 @@
       <description>Operations with ISO 8601 durations</description>
       <scope>optional</scope>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -149,6 +245,22 @@
       <description>Identify specific nodes in a JSON document (RFC 6901)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -170,6 +282,22 @@
       <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
       <scope>optional</scope>
       <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -210,6 +338,22 @@
       <description>Resolve a name to an object.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -230,6 +374,22 @@
       <description>Extensions to the standard Python datetime module</description>
       <scope>optional</scope>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -240,6 +400,22 @@
       <description>JSON Referencing + Python</description>
       <scope>optional</scope>
       <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -250,6 +426,22 @@
       <description>A pure python RFC3339 validator</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -260,6 +452,22 @@
       <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -270,6 +478,701 @@
       <description>Python bindings to Rust's persistent data structures (rpds)</description>
       <scope>optional</scope>
       <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -280,6 +1183,22 @@
       <description>Python 2 and 3 compatibility utilities</description>
       <scope>optional</scope>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -300,6 +1219,22 @@
       <description>Typing stubs for python-dateutil</description>
       <scope>optional</scope>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -310,6 +1245,22 @@
       <description>RFC 6570 URI Template Processor</description>
       <scope>optional</scope>
       <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -320,6 +1271,22 @@
       <description>A library for working with the color formats defined by HTML and CSS.</description>
       <scope>optional</scope>
       <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -330,6 +1297,22 @@
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
       <scope>optional</scope>
       <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
index b52cb485..acd2229e 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
@@ -10,9 +10,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -25,9 +27,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -40,9 +44,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -55,9 +61,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -70,9 +78,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -85,9 +95,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -100,9 +112,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -115,9 +129,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -130,9 +146,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -145,9 +163,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -160,9 +180,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -175,9 +197,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -190,279 +214,371 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -475,9 +591,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -490,9 +608,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -505,9 +625,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -520,9 +642,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -535,9 +659,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -550,9 +676,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -565,9 +693,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -580,300 +710,399 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -886,9 +1115,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -901,9 +1132,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -916,9 +1149,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -931,9 +1166,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -946,9 +1183,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -961,9 +1200,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
index 5d4bc77a..13c97c2d 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
@@ -5,10 +5,12 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
         }
@@ -24,10 +26,12 @@
       "description": "Classes Without Boilerplate",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
         }
@@ -43,10 +47,12 @@
       "description": "Python library for CycloneDX",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz"
         }
@@ -62,10 +68,12 @@
       "description": "XML bomb protection for Python stdlib modules",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz"
         }
@@ -81,10 +89,12 @@
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
         }
@@ -100,10 +110,12 @@
       "description": "Internationalized Domain Names in Applications (IDNA)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
         }
@@ -119,10 +131,12 @@
       "description": "Read resources from Python packages",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
         }
@@ -138,10 +152,12 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
         }
@@ -157,10 +173,12 @@
       "description": "Identify specific nodes in a JSON document (RFC 6901)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
         }
@@ -176,10 +194,12 @@
       "description": "An implementation of JSON Schema validation for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz"
         }
@@ -195,10 +215,12 @@
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
         }
@@ -214,10 +236,12 @@
       "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl"
         }
@@ -233,370 +257,462 @@
       "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz"
         }
@@ -612,10 +728,12 @@
       "description": "A purl aka. Package URL parser and builder",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl"
         }
@@ -631,10 +749,12 @@
       "description": "Resolve a name to an object.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
         }
@@ -650,10 +770,12 @@
       "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl"
         }
@@ -669,10 +791,12 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
         }
@@ -688,10 +812,12 @@
       "description": "JSON Referencing + Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
         }
@@ -707,10 +833,12 @@
       "description": "A pure python RFC3339 validator",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
         }
@@ -726,10 +854,12 @@
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
         }
@@ -745,398 +875,497 @@
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
         }
@@ -1152,10 +1381,12 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
         }
@@ -1171,10 +1402,12 @@
       "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz"
         }
@@ -1190,10 +1423,12 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
         }
@@ -1209,10 +1444,12 @@
       "description": "RFC 6570 URI Template Processor",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
         }
@@ -1228,10 +1465,12 @@
       "description": "A library for working with the color formats defined by HTML and CSS.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
         }
@@ -1247,10 +1486,12 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
         }
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
index 357c85d5..4b9d6050 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
@@ -30,9 +30,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -45,9 +47,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -60,9 +64,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -75,9 +81,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -90,9 +98,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -105,9 +115,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -120,9 +132,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -135,9 +149,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -150,9 +166,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -165,9 +183,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -180,9 +200,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -195,9 +217,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -210,279 +234,371 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -495,9 +611,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -510,9 +628,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -525,9 +645,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -540,9 +662,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -555,9 +679,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -570,9 +696,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -585,9 +713,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -600,300 +730,399 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -906,9 +1135,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -921,9 +1152,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -936,9 +1169,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -951,9 +1186,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -966,9 +1203,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -981,9 +1220,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
index 111ac8bf..2c36e7a1 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -36,6 +38,7 @@
       "description": "Classes Without Boilerplate",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -46,6 +49,7 @@
           "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -67,6 +71,7 @@
       "description": "Python library for CycloneDX",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -77,6 +82,7 @@
           "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -112,6 +118,7 @@
       "description": "XML bomb protection for Python stdlib modules",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -122,6 +129,7 @@
           "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -143,6 +151,7 @@
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -153,6 +162,7 @@
           "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -174,6 +184,7 @@
       "description": "Internationalized Domain Names in Applications (IDNA)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -184,6 +195,7 @@
           "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -205,6 +217,7 @@
       "description": "Read resources from Python packages",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -215,6 +228,7 @@
           "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -236,6 +250,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -246,6 +261,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -267,6 +283,7 @@
       "description": "Identify specific nodes in a JSON document (RFC 6901)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -277,6 +294,7 @@
           "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -298,6 +316,7 @@
       "description": "An implementation of JSON Schema validation for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -308,6 +327,7 @@
           "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -335,6 +355,7 @@
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -345,6 +366,7 @@
           "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -366,6 +388,7 @@
       "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -376,6 +399,7 @@
           "url": "https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -397,6 +421,7 @@
       "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -407,6 +432,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -417,6 +443,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -427,6 +454,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -437,6 +465,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -447,6 +476,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -457,6 +487,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -467,6 +498,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -477,6 +509,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -487,6 +520,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -497,6 +531,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -507,6 +542,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -517,6 +553,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -527,6 +564,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -537,6 +575,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -547,6 +586,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -557,6 +597,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -567,6 +608,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -577,6 +619,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -587,6 +630,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -597,6 +641,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -607,6 +652,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -617,6 +663,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -627,6 +674,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -637,6 +685,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -647,6 +696,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -657,6 +707,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -667,6 +718,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -677,6 +729,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -687,6 +740,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -697,6 +751,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -707,6 +762,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -717,6 +773,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -727,6 +784,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -737,6 +795,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -747,6 +806,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -757,6 +817,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -767,6 +828,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -777,6 +839,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -787,6 +850,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -797,6 +861,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -807,6 +872,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -817,6 +883,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -827,6 +894,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -837,6 +905,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -847,6 +916,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -857,6 +927,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -867,6 +938,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -877,6 +949,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -887,6 +960,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -897,6 +971,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -907,6 +982,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -917,6 +993,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -927,6 +1004,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -937,6 +1015,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -947,6 +1026,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -957,6 +1037,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -967,6 +1048,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -977,6 +1059,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -987,6 +1070,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -997,6 +1081,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1007,6 +1092,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1017,6 +1103,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1027,6 +1114,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1037,6 +1125,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1047,6 +1136,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1057,6 +1147,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1067,6 +1158,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1077,6 +1169,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1087,6 +1180,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1097,6 +1191,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1107,6 +1202,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1117,6 +1213,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1127,6 +1224,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1137,6 +1235,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1147,6 +1246,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1157,6 +1257,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1167,6 +1268,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1177,6 +1279,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1187,6 +1290,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1197,6 +1301,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1207,6 +1312,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1217,6 +1323,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1227,6 +1334,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1237,6 +1345,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1247,6 +1356,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1257,6 +1367,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1267,6 +1378,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1277,6 +1389,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1287,6 +1400,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1297,6 +1411,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1307,6 +1422,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1328,6 +1444,7 @@
       "description": "A purl aka. Package URL parser and builder",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1338,6 +1455,7 @@
           "url": "https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1359,6 +1477,7 @@
       "description": "Resolve a name to an object.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1369,6 +1488,7 @@
           "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1390,6 +1510,7 @@
       "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1400,6 +1521,7 @@
           "url": "https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1421,6 +1543,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1431,6 +1554,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1452,6 +1576,7 @@
       "description": "JSON Referencing + Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1462,6 +1587,7 @@
           "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1483,6 +1609,7 @@
       "description": "A pure python RFC3339 validator",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1493,6 +1620,7 @@
           "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1514,6 +1642,7 @@
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1524,6 +1653,7 @@
           "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1545,6 +1675,7 @@
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1555,6 +1686,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1565,6 +1697,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1575,6 +1708,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1585,6 +1719,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1595,6 +1730,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1605,6 +1741,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1615,6 +1752,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1625,6 +1763,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1635,6 +1774,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1645,6 +1785,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1655,6 +1796,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1665,6 +1807,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1675,6 +1818,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1685,6 +1829,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1695,6 +1840,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1705,6 +1851,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1715,6 +1862,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1725,6 +1873,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1735,6 +1884,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1745,6 +1895,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1755,6 +1906,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1765,6 +1917,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1775,6 +1928,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1785,6 +1939,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1795,6 +1950,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1805,6 +1961,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1815,6 +1972,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1825,6 +1983,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1835,6 +1994,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1845,6 +2005,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1855,6 +2016,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1865,6 +2027,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1875,6 +2038,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1885,6 +2049,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1895,6 +2060,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1905,6 +2071,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1915,6 +2082,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1925,6 +2093,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1935,6 +2104,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1945,6 +2115,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1955,6 +2126,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1965,6 +2137,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1975,6 +2148,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1985,6 +2159,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1995,6 +2170,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2005,6 +2181,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2015,6 +2192,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2025,6 +2203,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2035,6 +2214,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2045,6 +2225,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2055,6 +2236,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2065,6 +2247,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2075,6 +2258,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2085,6 +2269,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2095,6 +2280,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2105,6 +2291,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2115,6 +2302,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2125,6 +2313,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2135,6 +2324,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2145,6 +2335,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2155,6 +2346,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2165,6 +2357,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2175,6 +2368,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2185,6 +2379,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2195,6 +2390,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2205,6 +2401,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2215,6 +2412,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2225,6 +2423,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2235,6 +2434,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2245,6 +2445,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2255,6 +2456,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2265,6 +2467,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2275,6 +2478,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2285,6 +2489,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2295,6 +2500,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2305,6 +2511,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2315,6 +2522,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2325,6 +2533,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2335,6 +2544,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2345,6 +2555,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2355,6 +2566,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2365,6 +2577,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2375,6 +2588,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2385,6 +2599,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2395,6 +2610,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2405,6 +2621,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2415,6 +2632,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2425,6 +2643,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2435,6 +2654,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2445,6 +2665,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2455,6 +2676,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2465,6 +2687,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2475,6 +2698,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2485,6 +2709,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2495,6 +2720,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2505,6 +2731,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2515,6 +2742,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2525,6 +2753,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2546,6 +2775,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2556,6 +2786,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2577,6 +2808,7 @@
       "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2587,6 +2819,7 @@
           "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2608,6 +2841,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2618,6 +2852,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2639,6 +2874,7 @@
       "description": "RFC 6570 URI Template Processor",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2649,6 +2885,7 @@
           "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2670,6 +2907,7 @@
       "description": "A library for working with the color formats defined by HTML and CSS.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2680,6 +2918,7 @@
           "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2701,6 +2940,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2711,6 +2951,7 @@
           "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
index 3f9fc4e0..50047ebd 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
@@ -33,12 +33,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -54,12 +56,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
           </hashes>
@@ -75,12 +79,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
           </hashes>
@@ -101,12 +107,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
           </hashes>
@@ -122,12 +130,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
           </hashes>
@@ -143,12 +153,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
           </hashes>
@@ -164,12 +176,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
           </hashes>
@@ -185,12 +199,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -206,12 +222,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
           </hashes>
@@ -227,12 +245,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
           </hashes>
@@ -251,12 +271,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
           </hashes>
@@ -272,12 +294,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
           </hashes>
@@ -293,552 +317,644 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
           </hashes>
@@ -854,12 +970,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
           </hashes>
@@ -875,12 +993,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
           </hashes>
@@ -896,12 +1016,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
           </hashes>
@@ -917,12 +1039,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -938,12 +1062,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
           </hashes>
@@ -959,12 +1085,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
           </hashes>
@@ -980,12 +1108,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
           </hashes>
@@ -1001,594 +1131,693 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
           </hashes>
@@ -1604,12 +1833,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -1625,12 +1856,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
           </hashes>
@@ -1646,12 +1879,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
@@ -1667,12 +1902,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
           </hashes>
@@ -1688,12 +1925,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
           </hashes>
@@ -1709,12 +1948,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
index c6b3f6b6..d9e79e34 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -36,6 +38,7 @@
       "description": "Classes Without Boilerplate",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -46,6 +49,7 @@
           "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -67,6 +71,7 @@
       "description": "Python library for CycloneDX",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -77,6 +82,7 @@
           "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -112,6 +118,7 @@
       "description": "XML bomb protection for Python stdlib modules",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -122,6 +129,7 @@
           "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -143,6 +151,7 @@
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -153,6 +162,7 @@
           "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -174,6 +184,7 @@
       "description": "Internationalized Domain Names in Applications (IDNA)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -184,6 +195,7 @@
           "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -205,6 +217,7 @@
       "description": "Read resources from Python packages",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -215,6 +228,7 @@
           "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -236,6 +250,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -246,6 +261,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -267,6 +283,7 @@
       "description": "Identify specific nodes in a JSON document (RFC 6901)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -277,6 +294,7 @@
           "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -298,6 +316,7 @@
       "description": "An implementation of JSON Schema validation for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -308,6 +327,7 @@
           "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -335,6 +355,7 @@
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -345,6 +366,7 @@
           "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -366,6 +388,7 @@
       "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -376,6 +399,7 @@
           "url": "https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -397,6 +421,7 @@
       "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -407,6 +432,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -417,6 +443,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -427,6 +454,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -437,6 +465,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -447,6 +476,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -457,6 +487,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -467,6 +498,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -477,6 +509,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -487,6 +520,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -497,6 +531,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -507,6 +542,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -517,6 +553,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -527,6 +564,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -537,6 +575,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -547,6 +586,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -557,6 +597,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -567,6 +608,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -577,6 +619,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -587,6 +630,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -597,6 +641,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -607,6 +652,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -617,6 +663,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -627,6 +674,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -637,6 +685,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -647,6 +696,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -657,6 +707,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -667,6 +718,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -677,6 +729,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -687,6 +740,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -697,6 +751,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -707,6 +762,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -717,6 +773,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -727,6 +784,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -737,6 +795,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -747,6 +806,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -757,6 +817,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -767,6 +828,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -777,6 +839,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -787,6 +850,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -797,6 +861,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -807,6 +872,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -817,6 +883,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -827,6 +894,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -837,6 +905,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -847,6 +916,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -857,6 +927,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -867,6 +938,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -877,6 +949,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -887,6 +960,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -897,6 +971,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -907,6 +982,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -917,6 +993,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -927,6 +1004,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -937,6 +1015,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -947,6 +1026,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -957,6 +1037,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -967,6 +1048,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -977,6 +1059,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -987,6 +1070,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -997,6 +1081,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1007,6 +1092,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1017,6 +1103,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1027,6 +1114,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1037,6 +1125,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1047,6 +1136,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1057,6 +1147,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1067,6 +1158,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1077,6 +1169,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1087,6 +1180,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1097,6 +1191,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1107,6 +1202,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1117,6 +1213,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1127,6 +1224,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1137,6 +1235,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1147,6 +1246,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1157,6 +1257,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1167,6 +1268,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1177,6 +1279,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1187,6 +1290,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1197,6 +1301,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1207,6 +1312,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1217,6 +1323,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1227,6 +1334,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1237,6 +1345,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1247,6 +1356,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1257,6 +1367,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1267,6 +1378,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1277,6 +1389,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1287,6 +1400,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1297,6 +1411,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1307,6 +1422,7 @@
           "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1328,6 +1444,7 @@
       "description": "A purl aka. Package URL parser and builder",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1338,6 +1455,7 @@
           "url": "https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1359,6 +1477,7 @@
       "description": "Resolve a name to an object.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1369,6 +1488,7 @@
           "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1390,6 +1510,7 @@
       "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1400,6 +1521,7 @@
           "url": "https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1421,6 +1543,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1431,6 +1554,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1452,6 +1576,7 @@
       "description": "JSON Referencing + Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1462,6 +1587,7 @@
           "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1483,6 +1609,7 @@
       "description": "A pure python RFC3339 validator",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1493,6 +1620,7 @@
           "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1514,6 +1642,7 @@
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1524,6 +1653,7 @@
           "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1545,6 +1675,7 @@
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1555,6 +1686,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1565,6 +1697,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1575,6 +1708,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1585,6 +1719,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1595,6 +1730,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1605,6 +1741,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1615,6 +1752,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1625,6 +1763,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1635,6 +1774,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1645,6 +1785,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1655,6 +1796,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1665,6 +1807,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1675,6 +1818,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1685,6 +1829,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1695,6 +1840,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1705,6 +1851,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1715,6 +1862,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1725,6 +1873,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1735,6 +1884,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1745,6 +1895,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1755,6 +1906,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1765,6 +1917,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1775,6 +1928,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1785,6 +1939,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1795,6 +1950,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1805,6 +1961,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1815,6 +1972,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1825,6 +1983,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1835,6 +1994,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1845,6 +2005,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1855,6 +2016,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1865,6 +2027,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1875,6 +2038,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1885,6 +2049,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1895,6 +2060,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1905,6 +2071,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1915,6 +2082,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1925,6 +2093,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1935,6 +2104,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1945,6 +2115,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1955,6 +2126,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1965,6 +2137,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1975,6 +2148,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1985,6 +2159,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -1995,6 +2170,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2005,6 +2181,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2015,6 +2192,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2025,6 +2203,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2035,6 +2214,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2045,6 +2225,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2055,6 +2236,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2065,6 +2247,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2075,6 +2258,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2085,6 +2269,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2095,6 +2280,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2105,6 +2291,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2115,6 +2302,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2125,6 +2313,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2135,6 +2324,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2145,6 +2335,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2155,6 +2346,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2165,6 +2357,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2175,6 +2368,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2185,6 +2379,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2195,6 +2390,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2205,6 +2401,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2215,6 +2412,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2225,6 +2423,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2235,6 +2434,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2245,6 +2445,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2255,6 +2456,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2265,6 +2467,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2275,6 +2478,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2285,6 +2489,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2295,6 +2500,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2305,6 +2511,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2315,6 +2522,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2325,6 +2533,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2335,6 +2544,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2345,6 +2555,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2355,6 +2566,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2365,6 +2577,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2375,6 +2588,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2385,6 +2599,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2395,6 +2610,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2405,6 +2621,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2415,6 +2632,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2425,6 +2643,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2435,6 +2654,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2445,6 +2665,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2455,6 +2676,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2465,6 +2687,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2475,6 +2698,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2485,6 +2709,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2495,6 +2720,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2505,6 +2731,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2515,6 +2742,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2525,6 +2753,7 @@
           "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2546,6 +2775,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2556,6 +2786,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2577,6 +2808,7 @@
       "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2587,6 +2819,7 @@
           "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2608,6 +2841,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2618,6 +2852,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2639,6 +2874,7 @@
       "description": "RFC 6570 URI Template Processor",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2649,6 +2885,7 @@
           "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2670,6 +2907,7 @@
       "description": "A library for working with the color formats defined by HTML and CSS.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2680,6 +2918,7 @@
           "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2701,6 +2940,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -2711,6 +2951,7 @@
           "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
index 3f992213..fd85064b 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
@@ -60,12 +60,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -81,12 +83,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
           </hashes>
@@ -102,12 +106,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
           </hashes>
@@ -128,12 +134,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
           </hashes>
@@ -149,12 +157,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
           </hashes>
@@ -170,12 +180,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
           </hashes>
@@ -191,12 +203,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
           </hashes>
@@ -212,12 +226,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -233,12 +249,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
           </hashes>
@@ -254,12 +272,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
           </hashes>
@@ -278,12 +298,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
           </hashes>
@@ -299,12 +321,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
           </hashes>
@@ -320,552 +344,644 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
           </hashes>
@@ -881,12 +997,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
           </hashes>
@@ -902,12 +1020,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
           </hashes>
@@ -923,12 +1043,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
           </hashes>
@@ -944,12 +1066,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -965,12 +1089,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
           </hashes>
@@ -986,12 +1112,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
           </hashes>
@@ -1007,12 +1135,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
           </hashes>
@@ -1028,594 +1158,693 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
           </hashes>
@@ -1631,12 +1860,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -1652,12 +1883,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
           </hashes>
@@ -1673,12 +1906,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
@@ -1694,12 +1929,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
           </hashes>
@@ -1715,12 +1952,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
           </hashes>
@@ -1736,12 +1975,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin
index 3a5f5dfc..49274208 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin
@@ -6,42 +6,112 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
       <name>python-dateutil</name>
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
index 44a4c60c..7395b8d7 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
@@ -3,6 +3,18 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "purl": "pkg:pypi/arrow@1.3.0",
       "type": "library",
@@ -11,6 +23,18 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "purl": "pkg:pypi/colorama@0.4.6",
       "type": "library",
@@ -19,6 +43,18 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "purl": "pkg:pypi/isoduration@20.11.0",
       "type": "library",
@@ -27,6 +63,18 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "purl": "pkg:pypi/python-dateutil@2.8.2",
       "type": "library",
@@ -35,6 +83,18 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "purl": "pkg:pypi/six@1.16.0",
       "type": "library",
@@ -43,6 +103,18 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "purl": "pkg:pypi/toml@0.10.2",
       "type": "library",
@@ -51,6 +123,18 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
       "type": "library",
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
index c2d29676..d256210e 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
@@ -26,42 +26,112 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="colorama@0.4.6">
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="isoduration@20.11.0">
       <name>isoduration</name>
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="python-dateutil@2.8.2">
       <name>python-dateutil</name>
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="six@1.16.0">
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="toml@0.10.2">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
     <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
       <name>types-python-dateutil</name>
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
     </component>
   </components>
   <dependencies>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
index e5a27661..ae702b95 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -35,6 +83,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -53,6 +125,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -67,6 +163,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -81,6 +201,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -95,6 +239,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
index e14b902f..277cd445 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
@@ -26,6 +26,22 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -35,6 +51,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
         <property name="cdx:poetry:group">groupA</property>
@@ -45,6 +77,22 @@
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
         <property name="cdx:poetry:group">groupA</property>
@@ -55,6 +103,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -64,6 +128,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -73,6 +153,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -82,6 +178,22 @@
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin
index 5844e5bc..270a242e 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin
@@ -3,6 +3,30 @@
     {
       "bom-ref": "arrow@1.3.0",
       "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
       "name": "arrow",
       "properties": [
         {
@@ -17,6 +41,30 @@
     {
       "bom-ref": "colorama@0.4.6",
       "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
       "name": "colorama",
       "properties": [
         {
@@ -35,6 +83,30 @@
     {
       "bom-ref": "isoduration@20.11.0",
       "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
       "name": "isoduration",
       "properties": [
         {
@@ -53,6 +125,30 @@
     {
       "bom-ref": "python-dateutil@2.8.2",
       "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
       "name": "python-dateutil",
       "properties": [
         {
@@ -67,6 +163,30 @@
     {
       "bom-ref": "six@1.16.0",
       "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
       "name": "six",
       "properties": [
         {
@@ -81,6 +201,30 @@
     {
       "bom-ref": "toml@0.10.2",
       "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
       "name": "toml",
       "properties": [
         {
@@ -95,6 +239,30 @@
     {
       "bom-ref": "types-python-dateutil@2.8.19.14",
       "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
       "name": "types-python-dateutil",
       "properties": [
         {
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin
index 73004a25..91dea11d 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin
@@ -53,6 +53,22 @@
       <version>1.3.0</version>
       <description>Better dates &amp; times for Python</description>
       <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -62,6 +78,22 @@
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
       <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
         <property name="cdx:poetry:group">groupA</property>
@@ -72,6 +104,22 @@
       <version>20.11.0</version>
       <description>Operations with ISO 8601 durations</description>
       <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
         <property name="cdx:poetry:group">groupA</property>
@@ -82,6 +130,22 @@
       <version>2.8.2</version>
       <description>Extensions to the standard Python datetime module</description>
       <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -91,6 +155,22 @@
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
       <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
@@ -100,6 +180,22 @@
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
       <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
       </properties>
@@ -109,6 +205,22 @@
       <version>2.8.19.14</version>
       <description>Typing stubs for python-dateutil</description>
       <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
       <properties>
         <property name="cdx:poetry:group">dev</property>
       </properties>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin
index 0516f8eb..49274208 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin
@@ -9,9 +9,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -23,9 +25,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -37,9 +41,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -51,9 +57,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -65,9 +73,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -79,9 +89,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -93,9 +105,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
index 1e4d6eee..7395b8d7 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
@@ -5,10 +5,12 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
         }
@@ -23,10 +25,12 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
         }
@@ -41,10 +45,12 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
         }
@@ -59,10 +65,12 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
         }
@@ -77,10 +85,12 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
         }
@@ -95,10 +105,12 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
         }
@@ -113,10 +125,12 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "type": "distribution",
           "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
         }
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
index 946eddbf..d256210e 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
@@ -29,9 +29,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -43,9 +45,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -57,9 +61,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -71,9 +77,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -85,9 +93,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -99,9 +109,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
@@ -113,9 +125,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
index 03403cbb..32880fa8 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -35,6 +37,7 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -45,6 +48,7 @@
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +145,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +156,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +177,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +188,7 @@
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -203,6 +215,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -213,6 +226,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
index 37f7bb2c..9680e4e4 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
@@ -29,12 +29,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -49,12 +51,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
           </hashes>
@@ -72,12 +76,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -95,12 +101,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -115,12 +123,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -135,12 +145,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -158,12 +170,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin
index b453e0b8..166f9e2f 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin
@@ -5,6 +5,7 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -15,6 +16,7 @@
           "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -35,6 +37,7 @@
       "description": "Cross-platform colored terminal text.",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -45,6 +48,7 @@
           "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -71,6 +75,7 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -81,6 +86,7 @@
           "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -107,6 +113,7 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -117,6 +124,7 @@
           "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -137,6 +145,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -147,6 +156,7 @@
           "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -167,6 +177,7 @@
       "description": "Python Library for Tom's Obvious, Minimal Language",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -177,6 +188,7 @@
           "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -203,6 +215,7 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
@@ -213,6 +226,7 @@
           "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
         },
         {
+          "comment": "from legacy-api",
           "hashes": [
             {
               "alg": "SHA-256",
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin
index ba5c9169..80614ff3 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin
@@ -56,12 +56,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
           </hashes>
@@ -76,12 +78,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
           </hashes>
@@ -99,12 +103,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
           </hashes>
@@ -122,12 +128,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
           </hashes>
@@ -142,12 +150,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
           </hashes>
@@ -162,12 +172,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
           </hashes>
@@ -185,12 +197,14 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
           </hashes>
         </reference>
         <reference type="distribution">
           <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
           <hashes>
             <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
           </hashes>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin
new file mode 100644
index 00000000..3e215cfb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin
@@ -0,0 +1,33 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
new file mode 100644
index 00000000..541e67d2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
new file mode 100644
index 00000000..fbe5b508
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
@@ -0,0 +1,118 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=None)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "Pillow",
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=None)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
new file mode 100644
index 00000000..33692e92
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
@@ -0,0 +1,89 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
new file mode 100644
index 00000000..3326fcf6
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
@@ -0,0 +1,150 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=None)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=None)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
new file mode 100644
index 00000000..2c1bb1e2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
@@ -0,0 +1,103 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:source:package:reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:source:package:reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
new file mode 100644
index 00000000..2a80d871
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
@@ -0,0 +1,146 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=None)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=None)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
new file mode 100644
index 00000000..86deb17c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
@@ -0,0 +1,130 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:source:package:reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git (resolved_reference=None)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:source:package:reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin
new file mode 100644
index 00000000..3e215cfb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin
@@ -0,0 +1,33 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
new file mode 100644
index 00000000..5250fece
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
new file mode 100644
index 00000000..adde2d3a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
@@ -0,0 +1,118 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+        }
+      ],
+      "name": "Pillow",
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
new file mode 100644
index 00000000..f9ee555a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
@@ -0,0 +1,89 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
new file mode 100644
index 00000000..33161a66
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
@@ -0,0 +1,158 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "10.1.0"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "1.16.0"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
new file mode 100644
index 00000000..dd88d922
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
@@ -0,0 +1,105 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+        <property name="cdx:poetry:source:package:reference">10.1.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+        <property name="cdx:poetry:source:package:reference">1.16.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
new file mode 100644
index 00000000..70d31814
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
@@ -0,0 +1,154 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "10.1.0"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "1.16.0"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
new file mode 100644
index 00000000..c6f093da
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
@@ -0,0 +1,132 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+        <property name="cdx:poetry:source:package:reference">10.1.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+        <property name="cdx:poetry:source:package:reference">1.16.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin
new file mode 100644
index 00000000..3e215cfb
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin
@@ -0,0 +1,33 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
new file mode 100644
index 00000000..5250fece
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
new file mode 100644
index 00000000..adde2d3a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
@@ -0,0 +1,118 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+        }
+      ],
+      "name": "Pillow",
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
new file mode 100644
index 00000000..f9ee555a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
@@ -0,0 +1,89 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
new file mode 100644
index 00000000..1418b1b2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
@@ -0,0 +1,170 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "10.1.0"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "80f5e3a4e498641401868df4208b74581206afbee7cf7b8329daae82676d9463"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "1.16.0"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6ebb5019c6b999941a6cddd298dff7951d826239d663f6ce698b9547ae72d6b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
new file mode 100644
index 00000000..e90f1712
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
@@ -0,0 +1,111 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+        <property name="cdx:poetry:source:package:reference">10.1.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+          <hashes>
+            <hash alg="SHA-256">80f5e3a4e498641401868df4208b74581206afbee7cf7b8329daae82676d9463</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+        <property name="cdx:poetry:source:package:reference">1.16.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+          <hashes>
+            <hash alg="SHA-256">6ebb5019c6b999941a6cddd298dff7951d826239d663f6ce698b9547ae72d6b9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
new file mode 100644
index 00000000..99ad311f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
@@ -0,0 +1,166 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "10.1.0"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "80f5e3a4e498641401868df4208b74581206afbee7cf7b8329daae82676d9463"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "1.16.0"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6ebb5019c6b999941a6cddd298dff7951d826239d663f6ce698b9547ae72d6b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
new file mode 100644
index 00000000..e63491c8
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
@@ -0,0 +1,138 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
+          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+        <property name="cdx:poetry:source:package:reference">10.1.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+          <hashes>
+            <hash alg="SHA-256">80f5e3a4e498641401868df4208b74581206afbee7cf7b8329daae82676d9463</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
+          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+        <property name="cdx:poetry:source:package:reference">1.16.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+          <hashes>
+            <hash alg="SHA-256">6ebb5019c6b999941a6cddd298dff7951d826239d663f6ce698b9547ae72d6b9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>

From 1da3d314d2230c09158ddb66476f28dd928c23f2 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 19:41:50 +0100
Subject: [PATCH 111/155] more QA tools

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 CONTRIBUTING.md                                          | 4 ++++
 cyclonedx_py/__init__.py                                 | 1 +
 cyclonedx_py/_internal/poetry.py                         | 4 ++--
 cyclonedx_py/_internal/requirements.py                   | 8 ++++----
 pyproject.toml                                           | 9 ++++++---
 tests/__init__.py                                        | 6 +++---
 tests/_data/infiles/poetry/private-packges/pypi-proxy.py | 2 +-
 tests/integration/test_poetry.py                         | 8 ++++----
 tests/integration/test_requirements.py                   | 2 +-
 9 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 19a1219e..9b2a6156 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -26,6 +26,10 @@ poetry run isort .
 poetry run autopep8 -ir cyclonedx_py/ tests/
 ```
 
+This project prefers `f'strings'` over `'string'.format()`.  
+This project prefers `'single quotes'` over `"double quotes"`.  
+This project prefers `lower_snake_case` variable names.
+
 ## Documentation
 
 This project uses [Sphinx] to generate documentation which is automatically published to [RTFD][link_rtfd].
diff --git a/cyclonedx_py/__init__.py b/cyclonedx_py/__init__.py
index c121bc57..be8c1153 100644
--- a/cyclonedx_py/__init__.py
+++ b/cyclonedx_py/__init__.py
@@ -15,4 +15,5 @@
 
 # !! version is managed by semantic_release
 # do not use typing here, or else `semantic_release` might have issues finding the variable
+# flake8: noqa
 __version__ = "4.0.0-alpha.0"
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 2022ee71..99c5cbb7 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -73,11 +73,11 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
         from .utils.args import argparse_type4enum
 
-        p = ArgumentParser(description=dedent('''\
+        p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Poetry project.
 
                            The options mimic the respective ones from Poetry.
-                           '''),
+                           """),
                            **kwargs)
         # the args shall mimic the ones from Poetry, which uses comma-separated lists and multi-use
         p.add_argument('--without',
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index e771b36e..4716f781 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -41,12 +41,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
-        p = ArgumentParser(description=dedent('''\
+        p = ArgumentParser(description=dedent(""""\
                            Build an SBOM from Pip requirements.
 
                            The options mimic the respective ones from Pip.
-                           '''),
-                           epilog=dedent('''\
+                           """),
+                           epilog=dedent("""\
                            Example Usage:
                              • Build an SBOM from a requirements file:
                                    $ %(prog)s requirements-prod.txt
@@ -57,7 +57,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                              • Build an inventory from an unfrozen manifest:
                                    $ python3 -m pip install -r dependencies.txt &&\\
                                      python3 -m pip freeze | %(prog)s -
-                           '''),
+                           """),
                            **kwargs)
         # the args shall mimic the ones from Pip
         p.add_argument('-i', '--index-url',
diff --git a/pyproject.toml b/pyproject.toml
index 7c929bd0..eb23af98 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -60,11 +60,14 @@ coverage = "7.3.1"
 ddt = "1.6.0"
 flake8 = { version = "6.1.0", python = ">=3.8.1" }
 flake8-annotations = { version = "3.0.1", python = ">=3.8.1" }
-flake8-bugbear = { version = "23.7.10", python = ">=3.8.1" }
-flake8-isort = "6.0.0"
+flake8-bugbear = { version = "23.9.16", python = ">=3.8.1" }
+flake8-isort = "6.1.1"
+flake8-quotes = "3.3.2"
+flake8-use-fstring = "1.4"
+pep8-naming = "0.13.3"
 isort = "5.12.0"
 autopep8 = "2.0.4"
-mypy = "1.6.1"
+mypy = "1.7.0"
 bandit = "1.7.5"
 tox = "4.11.3"
 # `types-toml` need to stay in sync with version of `toml`
diff --git a/tests/__init__.py b/tests/__init__.py
index de182996..57cf5b58 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -25,7 +25,7 @@
 
 from cyclonedx.schema import OutputFormat
 
-from cyclonedx_py import __version__ as thisVersion
+from cyclonedx_py import __version__ as __this_version
 
 _TESTDATA_DIRECTORY = join(dirname(__file__), '_data')
 
@@ -74,7 +74,7 @@ def make_xml_comparable(bom: str) -> str:
     bom = bom.replace(  # replace metadata.tools.version
         '        <vendor>CycloneDX</vendor>\n'
         '        <name>cyclonedx-bom</name>\n'
-        f'        <version>{thisVersion}</version>',
+        f'        <version>{__this_version}</version>',
         '        <vendor>CycloneDX</vendor>\n'
         '        <name>cyclonedx-bom</name>\n'
         '        <version>thisVersion-testing</version>')
@@ -96,7 +96,7 @@ def make_json_comparable(bom: str) -> str:
     bom = bom.replace(  # replace metadata.tools.version
         '        "name": "cyclonedx-bom",\n'
         '        "vendor": "CycloneDX",\n'
-        f'        "version": {json_dumps(thisVersion)}',
+        f'        "version": {json_dumps(__this_version)}',
         '        "name": "cyclonedx-bom",\n'
         '        "vendor": "CycloneDX",\n'
         '        "version": "thisVersion-testing"')
diff --git a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
index 5ef0311f..39481a8f 100755
--- a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
+++ b/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
@@ -29,7 +29,7 @@
 
 
 class PypiProxyReqHandler(BaseHTTPRequestHandler):
-    def do_GET(self) -> None:
+    def do_GET(self) -> None:  # noqa:N802
         print('> ', self.path, file=sys.stderr)
         p, m = urlretrieve(f'https://pypi.org{self.path}')  # nosec B310
         print('< ', p, file=sys.stderr)
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 2fb9523c..23170bc8 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -117,9 +117,9 @@ def test_cli_fails_with_extras_not_found(self) -> None:
             out = out.getvalue()
         self.assertNotEqual(0, res, err)
         self.assertIn('Extra(s) ['
-                      "MNE-extra-A,"
-                      "MNE-extra-B,"
-                      "MNE-extra-C"
+                      'MNE-extra-A,'
+                      'MNE-extra-B,'
+                      'MNE-extra-C'
                       '] not specified', err)
 
     @named_data(*test_data)
@@ -185,5 +185,5 @@ def test_cli_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, o
             make_comparable(out, of),
             f'some-extras-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
 
-    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
+    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa:N802
         super().assertEqualSnapshot(actual, join('poetry', snapshot_name))
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index f97f9dc1..2b8eb56a 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -116,5 +116,5 @@ def test_cli_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: O
             make_comparable(out, of),
             f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}-stream')
 
-    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
+    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa:N802
         super().assertEqualSnapshot(actual, join('requirements', snapshot_name))

From 5b5de7bc9c55137d139b84cb5bb6403f14355308 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 22:21:18 +0100
Subject: [PATCH 112/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              | 117 +++++++++++------
 tests/_data/infiles/poetry/TODO.txt           |  10 --
 .../poetry/local/local_pckages/a/.gitignore   |   2 +
 .../dist/package_a-23.42-py2.py3-none-any.whl | Bin 0 -> 1424 bytes
 .../a/dist/package_a-23.42.tar.gz             | Bin 0 -> 993 bytes
 .../a/dist/unpacked/package_a-23.42/PKG-INFO  |  18 +++
 .../dist/unpacked/package_a-23.42/module_a.py |  19 +++
 .../unpacked/package_a-23.42/pyproject.toml   |  17 +++
 .../poetry/local/local_pckages/a/module_a.py  |  19 +++
 .../local/local_pckages/a/pyproject.toml      |  17 +++
 .../poetry/local/local_pckages/b/.gitignore   |   2 +
 .../package_b-1.33.7-py2.py3-none-any.whl     | Bin 0 -> 1432 bytes
 .../b/dist/package_b-1.33.7.tar.gz            | Bin 0 -> 1004 bytes
 .../poetry/local/local_pckages/b/module_b.py  |  19 +++
 .../local/local_pckages/b/pyproject.toml      |  17 +++
 .../poetry/local/local_pckages/c/.gitignore   |   2 +
 .../package_c-80.0.85-py2.py3-none-any.whl    | Bin 0 -> 1442 bytes
 .../c/dist/package_c-80.0.85.tar.gz           | Bin 0 -> 996 bytes
 .../poetry/local/local_pckages/c/module_c.py  |  19 +++
 .../local/local_pckages/c/pyproject.toml      |  17 +++
 .../infiles/poetry/local/lock10/poetry.lock   |  53 ++++++++
 .../poetry/local/lock10/pyproject.toml        |   1 +
 .../infiles/poetry/local/lock11/poetry.lock   |  50 ++++++++
 .../poetry/local/lock11/pyproject.toml        |   1 +
 .../infiles/poetry/local/lock20/poetry.lock   |  47 +++++++
 .../poetry/local/lock20/pyproject.toml        |   1 +
 .../infiles/poetry/local/pyproject-proto.toml |  25 ++++
 .../snapshots/poetry/local-lock10-1.0.xml.bin |  23 ++++
 .../snapshots/poetry/local-lock10-1.1.xml.bin |  38 ++++++
 .../poetry/local-lock10-1.2.json.bin          |  91 +++++++++++++
 .../snapshots/poetry/local-lock10-1.2.xml.bin |  68 ++++++++++
 .../poetry/local-lock10-1.3.json.bin          | 121 ++++++++++++++++++
 .../snapshots/poetry/local-lock10-1.3.xml.bin |  83 ++++++++++++
 .../poetry/local-lock10-1.4.json.bin          | 117 +++++++++++++++++
 .../snapshots/poetry/local-lock10-1.4.xml.bin | 110 ++++++++++++++++
 .../snapshots/poetry/local-lock11-1.0.xml.bin |  23 ++++
 .../snapshots/poetry/local-lock11-1.1.xml.bin |  38 ++++++
 .../poetry/local-lock11-1.2.json.bin          |  91 +++++++++++++
 .../snapshots/poetry/local-lock11-1.2.xml.bin |  68 ++++++++++
 .../poetry/local-lock11-1.3.json.bin          | 121 ++++++++++++++++++
 .../snapshots/poetry/local-lock11-1.3.xml.bin |  83 ++++++++++++
 .../poetry/local-lock11-1.4.json.bin          | 117 +++++++++++++++++
 .../snapshots/poetry/local-lock11-1.4.xml.bin | 110 ++++++++++++++++
 .../snapshots/poetry/local-lock20-1.0.xml.bin |  23 ++++
 .../snapshots/poetry/local-lock20-1.1.xml.bin |  38 ++++++
 .../poetry/local-lock20-1.2.json.bin          |  91 +++++++++++++
 .../snapshots/poetry/local-lock20-1.2.xml.bin |  68 ++++++++++
 .../poetry/local-lock20-1.3.json.bin          | 121 ++++++++++++++++++
 .../snapshots/poetry/local-lock20-1.3.xml.bin |  83 ++++++++++++
 .../poetry/local-lock20-1.4.json.bin          | 117 +++++++++++++++++
 .../snapshots/poetry/local-lock20-1.4.xml.bin | 110 ++++++++++++++++
 .../poetry/with-urls-lock10-1.1.xml.bin       |   4 +-
 .../poetry/with-urls-lock10-1.2.json.bin      |   4 +-
 .../poetry/with-urls-lock10-1.2.xml.bin       |   4 +-
 .../poetry/with-urls-lock10-1.3.json.bin      |   4 +-
 .../poetry/with-urls-lock10-1.3.xml.bin       |   4 +-
 .../poetry/with-urls-lock10-1.4.json.bin      |   4 +-
 .../poetry/with-urls-lock10-1.4.xml.bin       |   4 +-
 .../poetry/with-urls-lock11-1.1.xml.bin       |   4 +-
 .../poetry/with-urls-lock11-1.2.json.bin      |   4 +-
 .../poetry/with-urls-lock11-1.2.xml.bin       |   4 +-
 .../poetry/with-urls-lock11-1.3.json.bin      |   4 +-
 .../poetry/with-urls-lock11-1.3.xml.bin       |   4 +-
 .../poetry/with-urls-lock11-1.4.json.bin      |   4 +-
 .../poetry/with-urls-lock11-1.4.xml.bin       |   4 +-
 .../poetry/with-urls-lock20-1.1.xml.bin       |   4 +-
 .../poetry/with-urls-lock20-1.2.json.bin      |   4 +-
 .../poetry/with-urls-lock20-1.2.xml.bin       |   4 +-
 .../poetry/with-urls-lock20-1.3.json.bin      |   4 +-
 .../poetry/with-urls-lock20-1.3.xml.bin       |   4 +-
 .../poetry/with-urls-lock20-1.4.json.bin      |   4 +-
 .../poetry/with-urls-lock20-1.4.xml.bin       |   4 +-
 72 files changed, 2422 insertions(+), 88 deletions(-)
 delete mode 100644 tests/_data/infiles/poetry/TODO.txt
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/.gitignore
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42-py2.py3-none-any.whl
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42.tar.gz
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/module_a.py
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/module_a.py
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/.gitignore
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7.tar.gz
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/module_b.py
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/.gitignore
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85-py2.py3-none-any.whl
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85.tar.gz
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/module_c.py
 create mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/local/lock10/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/local/lock10/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/local/lock11/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/local/lock11/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/local/lock20/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/local/lock20/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/local/pyproject-proto.toml
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 99c5cbb7..f8a2ac01 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -408,6 +408,9 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
 
         from . import PropertyName
 
+        _is_public = package['source'].get('type') not in ['file', 'directory']
+        _is_package_src_vcs = self.__is_package_src_vcs(package)
+
         return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
             name=package['name'],
@@ -423,55 +426,97 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
                 Property(
                     name=PropertyName.PoetryPackageSourceReference.value,
                     value=package['source']['reference']
-                ) if self.__is_package_src_vcs(package) and 'reference' in package['source'] else None,
+                ) if _is_package_src_vcs and 'reference' in package['source'] else None,
                 Property(
                     name=PropertyName.PoetryPackageSourceResolvedReference.value,
                     value=package['source']['resolved_reference']
-                ) if self.__is_package_src_vcs(package) and 'resolved_reference' in package['source'] else None,
+                ) if _is_package_src_vcs and 'resolved_reference' in package['source'] else None,
             ]),
-            purl=PackageURL(type='pypi', name=package['name'], version=package['version']),
+            purl=PackageURL(type='pypi', name=package['name'], version=package['version']) if _is_public else None,
         )
 
     def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
-
-        # TODO:
-        #   - local deps
-
         source_type = package['source'].get('type', 'legacy')
         if 'legacy' == source_type:
-            source_url = package['source'].get('url', 'https://pypi.org/simple')
-            for file in package['files']:
-                try:
-                    yield ExternalReference(
-                        comment='from legacy-api',
-                        type=ExternalReferenceType.DISTRIBUTION,
-                        url=XsUri(f'{source_url}/{package["name"]}/#{file["file"]}'),
-                        hashes=[HashType.from_composite_str(file['hash'])]
-                    )
-                except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
-                    self._logger.debug('skipped dist-extRef for: %r | %r', package['name'], file, exc_info=error)
-                    del error
+            yield from self.__extrefs4lock_legacy(package)
         elif 'url' == source_type:
-            try:
-                yield ExternalReference(
-                    comment='from url',
-                    type=ExternalReferenceType.DISTRIBUTION,
-                    url=XsUri(package['source']['url']),
-                    hashes=[HashType.from_composite_str(package['files'][0]['hash'])] if len(package['files']) else None
-                )
-            except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
-                self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
-                del error
+            yield from self.__extrefs4lock_url(package)
+        elif 'file' == source_type:
+            yield from self.__extrefs4lock_file(package)
+        elif 'directory' == source_type:
+            yield from self.__extrefs4lock_directory(package)
         elif source_type in self.__PACKAGE_SRC_VCS:
+            yield from self.__extrefs4lock_vcs(package)
+
+    def __extrefs4lock_legacy(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+
+        source_url = package['source'].get('url', 'https://pypi.org/simple')
+        for file in package['files']:
             try:
                 yield ExternalReference(
-                    comment=f'from git (resolved_reference={package["source"].get("resolved_reference")})',
-                    type=ExternalReferenceType.VCS,
-                    url=XsUri(f'git+{package["source"]["url"]}#{package["source"].get("reference")}')
-                    # no hashes, has source.reference instead, which is a property
+                    comment='from legacy-api',
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(f'{source_url}/{package["name"]}/#{file["file"]}'),
+                    hashes=[HashType.from_composite_str(file['hash'])]
                 )
             except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
-                self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+                self._logger.debug('skipped dist-extRef for: %r | %r', package['name'], file, exc_info=error)
                 del error
+
+    def __extrefs4lock_url(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+
+        try:
+            yield ExternalReference(
+                comment='from url',
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri(package['source']['url']),
+                hashes=[HashType.from_composite_str(package['files'][0]['hash'])] if len(package['files']) else None
+            )
+        except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
+            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+
+    def __extrefs4lock_file(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+
+        try:
+            yield ExternalReference(
+                comment='from file',
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri(package['source']['url']),
+                hashes=[HashType.from_composite_str(package['files'][0]['hash'])] if len(package['files']) else None
+            )
+        except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
+            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+
+    def __extrefs4lock_directory(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+
+        try:
+            yield ExternalReference(
+                comment='from directory',
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri(package['source']['url'])
+                # no hash for a source-directory
+            )
+        except InvalidUriException as error:  # pragma: nocover
+            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+
+    def __extrefs4lock_vcs(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+
+        try:
+            yield ExternalReference(
+                comment=f'from VCS (resolved_reference={package["source"].get("resolved_reference")})',
+                type=ExternalReferenceType.VCS,
+                url=XsUri(f'git+{package["source"]["url"]}#{package["source"].get("reference")}')
+                # no hashes, has source.resolved_reference instead, which is a property
+            )
+        except InvalidUriException as error:  # pragma: nocover
+            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
diff --git a/tests/_data/infiles/poetry/TODO.txt b/tests/_data/infiles/poetry/TODO.txt
deleted file mode 100644
index 8b541591..00000000
--- a/tests/_data/infiles/poetry/TODO.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-- local deps (folder, wheel)
-- from urls: wheel, soure-archive, vcs-tag, vcs-commit, vcs-branch
-
-----
-
-You can specify a package in the following forms:
-    [...]
-    - A file path (../my-package/my-package.whl)
-    - A directory (../my-package/)
-    [...]
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/.gitignore b/tests/_data/infiles/poetry/local/local_pckages/a/.gitignore
new file mode 100644
index 00000000..a4d2bdf6
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/a/.gitignore
@@ -0,0 +1,2 @@
+# in these cases we need to keep the dists, for showcasing purposes
+!/dist/
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42-py2.py3-none-any.whl b/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42-py2.py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..19109874156999b0d8dd8da563cc295d4859da47
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42.tar.gz b/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..14486cda5572c5fdeb4ffb846e993ef91333210c
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO
new file mode 100644
index 00000000..37bea4c3
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO
@@ -0,0 +1,18 @@
+Metadata-Version: 2.1
+Name: package-a
+Version: 23.42
+Summary: some package A
+License: Apache-2.0
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 2
+Classifier: Programming Language :: Python :: 2.7
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.4
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/module_a.py b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/module_a.py
new file mode 100644
index 00000000..e804bc1a
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/module_a.py
@@ -0,0 +1,19 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+"""
+module A
+"""
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml
new file mode 100644
index 00000000..b99a015a
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml
@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "package-a"
+version = "23.42"
+description = "some package A"
+license = "Apache-2.0"
+authors = []
+packages = [
+  { include = "module_a.py" }
+]
+
+[tool.poetry.dependencies]
+python = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/module_a.py b/tests/_data/infiles/poetry/local/local_pckages/a/module_a.py
new file mode 100644
index 00000000..e804bc1a
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/a/module_a.py
@@ -0,0 +1,19 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+"""
+module A
+"""
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml
new file mode 100644
index 00000000..b99a015a
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml
@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "package-a"
+version = "23.42"
+description = "some package A"
+license = "Apache-2.0"
+authors = []
+packages = [
+  { include = "module_a.py" }
+]
+
+[tool.poetry.dependencies]
+python = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/.gitignore b/tests/_data/infiles/poetry/local/local_pckages/b/.gitignore
new file mode 100644
index 00000000..a4d2bdf6
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/b/.gitignore
@@ -0,0 +1,2 @@
+# in these cases we need to keep the dists, for showcasing purposes
+!/dist/
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl b/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..60d370d1003d237be7bb0c21492bce7bc19275cd
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7.tar.gz b/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..f7f9395e43525889020120f2a783e1bb61e9b010
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/module_b.py b/tests/_data/infiles/poetry/local/local_pckages/b/module_b.py
new file mode 100644
index 00000000..e23e0482
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/b/module_b.py
@@ -0,0 +1,19 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+"""
+module B
+"""
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml
new file mode 100644
index 00000000..b4745582
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml
@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "package-b"
+version = "1.33.7"
+description = "some package B"
+license = "Apache-2.0"
+authors = []
+packages = [
+  { include = "module_b.py" }
+]
+
+[tool.poetry.dependencies]
+python = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/.gitignore b/tests/_data/infiles/poetry/local/local_pckages/c/.gitignore
new file mode 100644
index 00000000..a4d2bdf6
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/c/.gitignore
@@ -0,0 +1,2 @@
+# in these cases we need to keep the dists, for showcasing purposes
+!/dist/
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85-py2.py3-none-any.whl b/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85-py2.py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..0767bfd18ef517a93c352a342596fe05cf2234d4
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85.tar.gz b/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..d09bb80f6d23c47f47ff8a826db282165fcbe661
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/module_c.py b/tests/_data/infiles/poetry/local/local_pckages/c/module_c.py
new file mode 100644
index 00000000..8cc519ad
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/c/module_c.py
@@ -0,0 +1,19 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+"""
+module C
+"""
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml
new file mode 100644
index 00000000..cd74ea77
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml
@@ -0,0 +1,17 @@
+[tool.poetry]
+name = "package-C"
+version = "80.0.85"
+description = "some package C"
+license = "Apache-2.0"
+authors = []
+packages = [
+  { include = "module_c.py" }
+]
+
+[tool.poetry.dependencies]
+python = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/lock10/poetry.lock b/tests/_data/infiles/poetry/local/lock10/poetry.lock
new file mode 100644
index 00000000..ae5c6c0e
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/lock10/poetry.lock
@@ -0,0 +1,53 @@
+[[package]]
+category = "main"
+description = "some package A"
+name = "package-a"
+optional = false
+python-versions = "*"
+version = "23.42"
+
+[package.source]
+reference = ""
+type = "file"
+url = "../local_pckages/a/dist/package_a-23.42.tar.gz"
+
+[[package]]
+category = "main"
+description = "some package B"
+name = "package-b"
+optional = false
+python-versions = "*"
+version = "1.33.7"
+
+[package.source]
+reference = ""
+type = "file"
+url = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+
+[[package]]
+category = "main"
+description = ""
+develop = true
+name = "package-c"
+optional = false
+python-versions = "*"
+version = "80.0.85"
+
+[package.source]
+reference = ""
+type = "directory"
+url = "../local_pckages/c"
+
+[metadata]
+content-hash = "4b28b28960b552d79f8976bc7bbd09ccf8fb6b3c1219785039fe47238a2f4615"
+lock-version = "1.0"
+python-versions = "^3.8"
+
+[metadata.files]
+package-a = [
+    {file = "package_a-23.42.tar.gz", hash = "sha256:ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"},
+]
+package-b = [
+    {file = "package_b-1.33.7-py2.py3-none-any.whl", hash = "sha256:9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"},
+]
+package-c = []
diff --git a/tests/_data/infiles/poetry/local/lock10/pyproject.toml b/tests/_data/infiles/poetry/local/lock10/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/lock10/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/local/lock11/poetry.lock b/tests/_data/infiles/poetry/local/lock11/poetry.lock
new file mode 100644
index 00000000..0b6e65df
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/lock11/poetry.lock
@@ -0,0 +1,50 @@
+[[package]]
+name = "package-a"
+version = "23.42"
+description = "some package A"
+category = "main"
+optional = false
+python-versions = "*"
+
+[package.source]
+type = "file"
+url = "../local_pckages/a/dist/package_a-23.42.tar.gz"
+
+[[package]]
+name = "package-b"
+version = "1.33.7"
+description = "some package B"
+category = "main"
+optional = false
+python-versions = "*"
+
+[package.source]
+type = "file"
+url = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+
+[[package]]
+name = "package-c"
+version = "80.0.85"
+description = "some package C"
+category = "main"
+optional = false
+python-versions = "*"
+develop = false
+
+[package.source]
+type = "directory"
+url = "../local_pckages/c"
+
+[metadata]
+lock-version = "1.1"
+python-versions = "^3.8"
+content-hash = "4b28b28960b552d79f8976bc7bbd09ccf8fb6b3c1219785039fe47238a2f4615"
+
+[metadata.files]
+package-a = [
+    {file = "package_a-23.42.tar.gz", hash = "sha256:ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"},
+]
+package-b = [
+    {file = "package_b-1.33.7-py2.py3-none-any.whl", hash = "sha256:9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"},
+]
+package-c = []
diff --git a/tests/_data/infiles/poetry/local/lock11/pyproject.toml b/tests/_data/infiles/poetry/local/lock11/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/lock11/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/local/lock20/poetry.lock b/tests/_data/infiles/poetry/local/lock20/poetry.lock
new file mode 100644
index 00000000..31efac25
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/lock20/poetry.lock
@@ -0,0 +1,47 @@
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+
+[[package]]
+name = "package-a"
+version = "23.42"
+description = "some package A"
+optional = false
+python-versions = "*"
+files = [
+    {file = "package_a-23.42.tar.gz", hash = "sha256:ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"},
+]
+
+[package.source]
+type = "file"
+url = "../local_pckages/a/dist/package_a-23.42.tar.gz"
+
+[[package]]
+name = "package-b"
+version = "1.33.7"
+description = "some package B"
+optional = false
+python-versions = "*"
+files = [
+    {file = "package_b-1.33.7-py2.py3-none-any.whl", hash = "sha256:9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"},
+]
+
+[package.source]
+type = "file"
+url = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+
+[[package]]
+name = "package-c"
+version = "80.0.85"
+description = "some package C"
+optional = false
+python-versions = "*"
+files = []
+develop = false
+
+[package.source]
+type = "directory"
+url = "../local_pckages/c"
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.8"
+content-hash = "4b28b28960b552d79f8976bc7bbd09ccf8fb6b3c1219785039fe47238a2f4615"
diff --git a/tests/_data/infiles/poetry/local/lock20/pyproject.toml b/tests/_data/infiles/poetry/local/lock20/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/lock20/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/local/pyproject-proto.toml b/tests/_data/infiles/poetry/local/pyproject-proto.toml
new file mode 100644
index 00000000..fbc09a20
--- /dev/null
+++ b/tests/_data/infiles/poetry/local/pyproject-proto.toml
@@ -0,0 +1,25 @@
+[tool.poetry]
+name = "local"
+version = "0.1.0"
+description = "packages from local paths"
+authors = ["Your Name <you@example.com>"]
+
+
+# You can specify a package in the following forms:
+#    [...]
+#    - A file path (../my-package/my-package.whl)
+#    - A directory (../my-package/)
+#    [...]
+
+
+[tool.poetry.dependencies]
+python = "^3.8"
+package-a = {path = "../local_pckages/a/dist/package_a-23.42.tar.gz"}
+package-b = {path = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"}
+package-c = {path = "../local_pckages/c"}
+
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin
new file mode 100644
index 00000000..b56f3334
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description/>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin
new file mode 100644
index 00000000..396c481b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
new file mode 100644
index 00000000..d4ef5d46
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
@@ -0,0 +1,91 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
new file mode 100644
index 00000000..d8b41574
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
@@ -0,0 +1,68 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
new file mode 100644
index 00000000..c8167960
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
@@ -0,0 +1,121 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
new file mode 100644
index 00000000..bd9b702d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin
new file mode 100644
index 00000000..4f43775a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin
@@ -0,0 +1,117 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin
new file mode 100644
index 00000000..7dc04900
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin
@@ -0,0 +1,110 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin
new file mode 100644
index 00000000..6f4c891b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin
new file mode 100644
index 00000000..1df48126
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
new file mode 100644
index 00000000..c4465b87
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
@@ -0,0 +1,91 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
new file mode 100644
index 00000000..1a127be5
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
@@ -0,0 +1,68 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
new file mode 100644
index 00000000..e8ca6a69
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
@@ -0,0 +1,121 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
new file mode 100644
index 00000000..b00153b3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin
new file mode 100644
index 00000000..0dc6df14
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin
@@ -0,0 +1,117 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin
new file mode 100644
index 00000000..b5b233b6
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin
@@ -0,0 +1,110 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin
new file mode 100644
index 00000000..6f4c891b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin
new file mode 100644
index 00000000..1df48126
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
new file mode 100644
index 00000000..c4465b87
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
@@ -0,0 +1,91 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
new file mode 100644
index 00000000..1a127be5
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
@@ -0,0 +1,68 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
new file mode 100644
index 00000000..e8ca6a69
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
@@ -0,0 +1,121 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
new file mode 100644
index 00000000..b00153b3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin
new file mode 100644
index 00000000..0dc6df14
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin
@@ -0,0 +1,117 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@1.33.7",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "package-c@80.0.85",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "80.0.85"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@1.33.7",
+        "package-c@80.0.85"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@1.33.7"
+    },
+    {
+      "ref": "package-c@80.0.85"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin
new file mode 100644
index 00000000..b5b233b6
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin
@@ -0,0 +1,110 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@1.33.7">
+      <name>package-b</name>
+      <version>1.33.7</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@80.0.85">
+      <name>package-c</name>
+      <version>80.0.85</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@1.33.7"/>
+      <dependency ref="package-c@80.0.85"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@1.33.7"/>
+    <dependency ref="package-c@80.0.85"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
index 541e67d2..924e7a9a 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
@@ -9,7 +9,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
     </component>
@@ -33,7 +33,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
index fbe5b508..fa8aaaf2 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=None)",
+          "comment": "from VCS (resolved_reference=None)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
@@ -35,7 +35,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=None)",
+          "comment": "from VCS (resolved_reference=None)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
index 33692e92..c5dd7986 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
@@ -29,7 +29,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
     </component>
@@ -53,7 +53,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
index 3326fcf6..2fbd337f 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=None)",
+          "comment": "from VCS (resolved_reference=None)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
@@ -51,7 +51,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=None)",
+          "comment": "from VCS (resolved_reference=None)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
index 2c1bb1e2..987a1cf3 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
@@ -29,7 +29,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -60,7 +60,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
       <properties>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
index 2a80d871..5492acc4 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=None)",
+          "comment": "from VCS (resolved_reference=None)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
@@ -51,7 +51,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=None)",
+          "comment": "from VCS (resolved_reference=None)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
index 86deb17c..defd313f 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
@@ -56,7 +56,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -87,7 +87,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from git (resolved_reference=None)</comment>
+          <comment>from VCS (resolved_reference=None)</comment>
         </reference>
       </externalReferences>
       <properties>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
index 5250fece..193a101a 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
@@ -9,7 +9,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
     </component>
@@ -33,7 +33,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
index adde2d3a..4f3a77bf 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
         }
@@ -35,7 +35,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
index f9ee555a..9a9a0596 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
@@ -29,7 +29,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
     </component>
@@ -53,7 +53,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
index 33161a66..f5a96280 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
         }
@@ -55,7 +55,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
index dd88d922..060740d4 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
@@ -29,7 +29,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -61,7 +61,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
       <properties>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
index 70d31814..91ea39e2 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
         }
@@ -55,7 +55,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
index c6f093da..71c6eff9 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
@@ -56,7 +56,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -88,7 +88,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
       <properties>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
index 5250fece..193a101a 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
@@ -9,7 +9,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
     </component>
@@ -33,7 +33,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
index adde2d3a..4f3a77bf 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
         }
@@ -35,7 +35,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
index f9ee555a..9a9a0596 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
@@ -29,7 +29,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
     </component>
@@ -53,7 +53,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
index 1418b1b2..98f1033d 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
         }
@@ -61,7 +61,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
index e90f1712..3d91a12d 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
@@ -29,7 +29,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -64,7 +64,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
       <properties>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
index 99ad311f..ac67a8e7 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
         }
@@ -61,7 +61,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
         }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
index e63491c8..7d12e98e 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
@@ -56,7 +56,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from git (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -91,7 +91,7 @@
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from git (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
         </reference>
       </externalReferences>
       <properties>

From 90ec4219d413b16e4858cfbe935aae5d23ce1178 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 14 Nov 2023 22:26:22 +0100
Subject: [PATCH 113/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index f8a2ac01..bf13da2d 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -396,11 +396,16 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
                     del error
 
     __PACKAGE_SRC_VCS = ['git']
+    __PACKAGE_SRC_LOCAL = ['file', 'directory']
 
     @classmethod
     def __is_package_src_vcs(cls, package: 'NameDict') -> bool:
         return package['source'].get('type') in cls.__PACKAGE_SRC_VCS
 
+    @classmethod
+    def __is_package_src_local(cls, package: 'NameDict') -> bool:
+        return package['source'].get('type') in cls.__PACKAGE_SRC_LOCAL
+
     def __make_component4lock(self, package: 'NameDict') -> 'Component':
         from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentScope
@@ -408,8 +413,8 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
 
         from . import PropertyName
 
-        _is_public = package['source'].get('type') not in ['file', 'directory']
         _is_package_src_vcs = self.__is_package_src_vcs(package)
+        _is_local = self.__is_package_src_local(package)
 
         return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
@@ -432,7 +437,10 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
                     value=package['source']['resolved_reference']
                 ) if _is_package_src_vcs and 'resolved_reference' in package['source'] else None,
             ]),
-            purl=PackageURL(type='pypi', name=package['name'], version=package['version']) if _is_public else None,
+            purl=None if _is_local else PackageURL(
+                type='pypi',
+                name=package['name'],
+                version=package['version'])
         )
 
     def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:

From 322d810a68e4bbdec0fb756227c32272881f8370 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Wed, 15 Nov 2023 13:21:18 +0100
Subject: [PATCH 114/155] attribs

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/_data/snapshots/.gitattributes | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/_data/snapshots/.gitattributes b/tests/_data/snapshots/.gitattributes
index 932f6997..3c0b93a6 100644
--- a/tests/_data/snapshots/.gitattributes
+++ b/tests/_data/snapshots/.gitattributes
@@ -1,4 +1,5 @@
 # files are compared bype-wise, so they need to be treated as binary
-*.bin       linguist-generated binary
-*.xml*.bin   linguist-generated binary diff=xml
-*.json*.bin  linguist-generated binary diff=json
+*            linguist-generated
+*.bin        binary
+*.xml*.bin   diff=xml
+*.json*.bin  diff=json

From d00cd16fcc7fbf3a936cdf181d735954c2f5e38f Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 16 Nov 2023 15:27:34 +0100
Subject: [PATCH 115/155] FQ purls

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              | 52 +++++++++++--------
 .../poetry/with-urls-lock10-1.0.xml.bin       |  6 +--
 .../poetry/with-urls-lock10-1.1.xml.bin       | 10 ++--
 .../poetry/with-urls-lock10-1.2.json.bin      | 10 ++--
 .../poetry/with-urls-lock10-1.2.xml.bin       | 10 ++--
 .../poetry/with-urls-lock10-1.3.json.bin      | 10 ++--
 .../poetry/with-urls-lock10-1.3.xml.bin       | 10 ++--
 .../poetry/with-urls-lock10-1.4.json.bin      | 10 ++--
 .../poetry/with-urls-lock10-1.4.xml.bin       | 10 ++--
 .../poetry/with-urls-lock11-1.0.xml.bin       |  6 +--
 .../poetry/with-urls-lock11-1.1.xml.bin       | 14 ++---
 .../poetry/with-urls-lock11-1.2.json.bin      | 14 ++---
 .../poetry/with-urls-lock11-1.2.xml.bin       | 14 ++---
 .../poetry/with-urls-lock11-1.3.json.bin      | 14 ++---
 .../poetry/with-urls-lock11-1.3.xml.bin       | 14 ++---
 .../poetry/with-urls-lock11-1.4.json.bin      | 14 ++---
 .../poetry/with-urls-lock11-1.4.xml.bin       | 14 ++---
 .../poetry/with-urls-lock20-1.0.xml.bin       |  6 +--
 .../poetry/with-urls-lock20-1.1.xml.bin       | 14 ++---
 .../poetry/with-urls-lock20-1.2.json.bin      | 14 ++---
 .../poetry/with-urls-lock20-1.2.xml.bin       | 14 ++---
 .../poetry/with-urls-lock20-1.3.json.bin      | 14 ++---
 .../poetry/with-urls-lock20-1.3.xml.bin       | 14 ++---
 .../poetry/with-urls-lock20-1.4.json.bin      | 14 ++---
 .../poetry/with-urls-lock20-1.4.xml.bin       | 14 ++---
 25 files changed, 172 insertions(+), 164 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index bf13da2d..cbaa459f 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -395,17 +395,9 @@ def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None,
                     self._logger.debug('skipping hash %s', file['hash'], exc_info=error)
                     del error
 
-    __PACKAGE_SRC_VCS = ['git']
+    __PACKAGE_SRC_VCS = ['git']  # not supported yet: hg, svn
     __PACKAGE_SRC_LOCAL = ['file', 'directory']
 
-    @classmethod
-    def __is_package_src_vcs(cls, package: 'NameDict') -> bool:
-        return package['source'].get('type') in cls.__PACKAGE_SRC_VCS
-
-    @classmethod
-    def __is_package_src_local(cls, package: 'NameDict') -> bool:
-        return package['source'].get('type') in cls.__PACKAGE_SRC_LOCAL
-
     def __make_component4lock(self, package: 'NameDict') -> 'Component':
         from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentScope
@@ -413,13 +405,26 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
 
         from . import PropertyName
 
-        _is_package_src_vcs = self.__is_package_src_vcs(package)
-        _is_local = self.__is_package_src_local(package)
+        source = package['source']
+        is_vcs = source.get('type') in self.__PACKAGE_SRC_VCS
+        is_local = source.get('type') in self.__PACKAGE_SRC_LOCAL
+
+        purl_qualifiers = {}  # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+        if is_vcs:
+            # see section 3.7.4 in https://github.com/spdx/spdx-spec/blob/cfa1b9d08903/chapters/3-package-information.md
+            # > For version-controlled files, the VCS location syntax is similar to a URL and has the:
+            # > `<vcs_tool>+<transport>://<host_name>[/<path_to_repository>][@<revision_tag_or_branch>][#<sub_path>]`
+            purl_qualifiers['vcs_url'] = f'{source["type"]}+{source["url"]}@' +\
+                                         source.get('resolved_reference', source.get('reference', ''))
+        elif package['source'].get('type') == 'url':
+            if '://files.pythonhosted.org/' not in package['source']['url']:
+                # skip PURL bloat, do not add implicit information
+                purl_qualifiers['download_url'] = package['source']['url']
 
         return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
             name=package['name'],
-            version=package['version'],
+            version=package.get('version'),
             description=package.get('description'),
             scope=ComponentScope.OPTIONAL if package.get('optional') else None,
             external_references=self.__extrefs4lock(package),
@@ -430,17 +435,18 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
                 ) if 'category' in package else None,
                 Property(
                     name=PropertyName.PoetryPackageSourceReference.value,
-                    value=package['source']['reference']
-                ) if _is_package_src_vcs and 'reference' in package['source'] else None,
+                    value=source['reference']
+                ) if is_vcs and 'reference' in source else None,
                 Property(
                     name=PropertyName.PoetryPackageSourceResolvedReference.value,
-                    value=package['source']['resolved_reference']
-                ) if _is_package_src_vcs and 'resolved_reference' in package['source'] else None,
+                    value=source['resolved_reference']
+                ) if is_vcs and 'resolved_reference' in source else None,
             ]),
-            purl=None if _is_local else PackageURL(
-                type='pypi',
-                name=package['name'],
-                version=package['version'])
+            purl=PackageURL(type='pypi',
+                            name=package['name'],
+                            version=package['version'],
+                            qualifiers=purl_qualifiers
+                            ) if not is_local else None
         )
 
     def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
@@ -519,11 +525,13 @@ def __extrefs4lock_vcs(self, package: 'NameDict') -> Generator['ExternalReferenc
         from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
 
+        source = package['source']
+        vcs_ref = source.get('resolved_reference', source.get('reference', ''))
         try:
             yield ExternalReference(
-                comment=f'from VCS (resolved_reference={package["source"].get("resolved_reference")})',
+                comment='from VCS',
                 type=ExternalReferenceType.VCS,
-                url=XsUri(f'git+{package["source"]["url"]}#{package["source"].get("reference")}')
+                url=XsUri(f'{source["type"]}+{source["url"]}#{vcs_ref}')
                 # no hashes, has source.resolved_reference instead, which is a property
             )
         except InvalidUriException as error:  # pragma: nocover
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin
index 3e215cfb..02dcb259 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin
@@ -5,7 +5,7 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <modified>false</modified>
     </component>
     <component type="library">
@@ -19,14 +19,14 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
index 924e7a9a..512c4e2c 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
@@ -5,11 +5,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -29,11 +29,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -41,7 +41,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
index fa8aaaf2..812beb54 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
@@ -5,13 +5,13 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=None)",
+          "comment": "from VCS",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
       "name": "Pillow",
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -35,13 +35,13 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=None)",
+          "comment": "from VCS",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
       "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -56,7 +56,7 @@
         }
       ],
       "name": "wxPython",
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
index c5dd7986..51ca297a 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
@@ -25,11 +25,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -49,11 +49,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -61,7 +61,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
index 2fbd337f..4e647f9e 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=None)",
+          "comment": "from VCS",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
@@ -21,7 +21,7 @@
           "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -51,7 +51,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=None)",
+          "comment": "from VCS",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
@@ -67,7 +67,7 @@
           "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -88,7 +88,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
index 987a1cf3..ee9a8cdd 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
@@ -25,11 +25,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -56,11 +56,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -72,7 +72,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
index 5492acc4..0ea86c8b 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
@@ -5,7 +5,7 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=None)",
+          "comment": "from VCS",
           "type": "vcs",
           "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
@@ -21,7 +21,7 @@
           "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -51,7 +51,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=None)",
+          "comment": "from VCS",
           "type": "vcs",
           "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
@@ -67,7 +67,7 @@
           "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -88,7 +88,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
index defd313f..c5fc92d4 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
@@ -52,11 +52,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -83,11 +83,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
           <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
-          <comment>from VCS (resolved_reference=None)</comment>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -99,7 +99,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin
index 3e215cfb..02dcb259 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin
@@ -5,7 +5,7 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <modified>false</modified>
     </component>
     <component type="library">
@@ -19,14 +19,14 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
index 193a101a..512c4e2c 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
@@ -5,11 +5,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -29,11 +29,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -41,7 +41,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
index 4f3a77bf..812beb54 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
@@ -5,13 +5,13 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
       "name": "Pillow",
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -35,13 +35,13 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
       "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -56,7 +56,7 @@
         }
       ],
       "name": "wxPython",
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
index 9a9a0596..51ca297a 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
@@ -25,11 +25,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -49,11 +49,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -61,7 +61,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
index f5a96280..521185cb 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
@@ -5,9 +5,9 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
       "name": "Pillow",
@@ -25,7 +25,7 @@
           "value": "10.1.0"
         }
       ],
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -55,9 +55,9 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
       "name": "six",
@@ -75,7 +75,7 @@
           "value": "1.16.0"
         }
       ],
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -96,7 +96,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
index 060740d4..e43b0e36 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
@@ -25,11 +25,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -57,11 +57,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -74,7 +74,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
index 91ea39e2..9e4a41dd 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
@@ -5,9 +5,9 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
       "name": "Pillow",
@@ -25,7 +25,7 @@
           "value": "10.1.0"
         }
       ],
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -55,9 +55,9 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
       "name": "six",
@@ -75,7 +75,7 @@
           "value": "1.16.0"
         }
       ],
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -96,7 +96,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
index 71c6eff9..fa3526cb 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
@@ -52,11 +52,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -84,11 +84,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -101,7 +101,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin
index 3e215cfb..02dcb259 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin
@@ -5,7 +5,7 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <modified>false</modified>
     </component>
     <component type="library">
@@ -19,14 +19,14 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
index 193a101a..512c4e2c 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
@@ -5,11 +5,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -29,11 +29,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -41,7 +41,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
index 4f3a77bf..812beb54 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
@@ -5,13 +5,13 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
       "name": "Pillow",
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -35,13 +35,13 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
       "name": "six",
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -56,7 +56,7 @@
         }
       ],
       "name": "wxPython",
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
index 9a9a0596..51ca297a 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
@@ -25,11 +25,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -49,11 +49,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
     </component>
@@ -61,7 +61,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
index 98f1033d..10c8b386 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
@@ -5,9 +5,9 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
       "name": "Pillow",
@@ -25,7 +25,7 @@
           "value": "10.1.0"
         }
       ],
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -61,9 +61,9 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
       "name": "six",
@@ -81,7 +81,7 @@
           "value": "1.16.0"
         }
       ],
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -108,7 +108,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
index 3d91a12d..fd138e61 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
@@ -25,11 +25,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -60,11 +60,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -77,7 +77,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
index ac67a8e7..988cb6e2 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
@@ -5,9 +5,9 @@
       "description": "Python Imaging Library (Fork)",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+https://github.com/python-pillow/Pillow.git#10.1.0"
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
         }
       ],
       "name": "Pillow",
@@ -25,7 +25,7 @@
           "value": "10.1.0"
         }
       ],
-      "purl": "pkg:pypi/pillow@10.1.0",
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
       "type": "library",
       "version": "10.1.0"
     },
@@ -61,9 +61,9 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)",
+          "comment": "from VCS",
           "type": "vcs",
-          "url": "git+ssh://git@github.com/benjaminp/six.git#1.16.0"
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
         }
       ],
       "name": "six",
@@ -81,7 +81,7 @@
           "value": "1.16.0"
         }
       ],
-      "purl": "pkg:pypi/six@1.16.0",
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
       "type": "library",
       "version": "1.16.0"
     },
@@ -108,7 +108,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f",
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
       "type": "library",
       "version": "4.2.2a1.dev5618+1f82021f"
     }
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
index 7d12e98e..3fe09d88 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
@@ -52,11 +52,11 @@
       <name>Pillow</name>
       <version>10.1.0</version>
       <description>Python Imaging Library (Fork)</description>
-      <purl>pkg:pypi/pillow@10.1.0</purl>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+https://github.com/python-pillow/Pillow.git#10.1.0</url>
-          <comment>from VCS (resolved_reference=da59ad000d1405eaecd557175e29083a87d19f7c)</comment>
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -87,11 +87,11 @@
       <name>six</name>
       <version>1.16.0</version>
       <description>Python 2 and 3 compatibility utilities</description>
-      <purl>pkg:pypi/six@1.16.0</purl>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
       <externalReferences>
         <reference type="vcs">
-          <url>git+ssh://git@github.com/benjaminp/six.git#1.16.0</url>
-          <comment>from VCS (resolved_reference=65486e4383f9f411da95937451205d3c7b61b9e1)</comment>
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
         </reference>
       </externalReferences>
       <properties>
@@ -104,7 +104,7 @@
       <name>wxPython</name>
       <version>4.2.2a1.dev5618+1f82021f</version>
       <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
-      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f</purl>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>

From 43dcfaf62213af3209889a6dffa59ad9583081b9 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 16 Nov 2023 19:49:55 +0100
Subject: [PATCH 116/155] fix putl and shorten-cli-switch

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py                 |  66 ++++++--
 cyclonedx_py/_internal/poetry.py              |   2 +-
 cyclonedx_py/_internal/utils/args.py          |   2 +-
 .../_data/snapshots/cli/purls-normal.json.bin |  81 +++++++++
 .../_data/snapshots/cli/purls-short.json.bin  |  81 +++++++++
 tests/unit/__init__.py                        |  16 ++
 tests/unit/test_cli.py                        | 158 ++++++++++++++++++
 7 files changed, 389 insertions(+), 17 deletions(-)
 create mode 100644 tests/_data/snapshots/cli/purls-normal.json.bin
 create mode 100644 tests/_data/snapshots/cli/purls-short.json.bin
 create mode 100644 tests/unit/__init__.py
 create mode 100644 tests/unit/test_cli.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index e126ae05..d3e7045b 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -34,6 +34,7 @@
     from logging import Logger
 
     from cyclonedx.model.bom import Bom
+    from cyclonedx.model.component import Component
 
     from . import BomBuilder
 
@@ -60,6 +61,13 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                               required=False)
 
         op = ArgumentParser(add_help=False)
+        op.add_argument('--short-PURLs',
+                        help='Omit all qualifiers from PackageURLs.\n'
+                             'This causes information loss in trade-off shorter PURLs, '
+                             'which might improve ingesting these strings.',
+                        action='store_true',
+                        dest='short_purls',
+                        default=False)
         op.add_argument('-o', '--outfile',
                         metavar='FILE',
                         help='Output file path for your SBOM (set to "-" to output to STDOUT) (default: %(default)s)',
@@ -69,7 +77,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
         op.add_argument('--sv', '--schema-version',
                         metavar='VERSION',
                         help='The CycloneDX schema version for your SBOM'
-                             f' {{choice: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}'
+                             f' {{choices: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}'
                              ' (default: %(default)s)',
                         dest='schema_version',
                         choices=SchemaVersion,
@@ -86,7 +94,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
             op.add_argument('--validate',
                             help='Whether validate the result before outputting (default: %(default)s)',
                             action=BooleanOptionalAction,
-                            dest='validate',
+                            dest='should_validate',
                             default=True)
         else:
             vg = op.add_mutually_exclusive_group()
@@ -127,20 +135,45 @@ def _clean_kwargs(cls, kwargs: Dict[str, Any]) -> Dict[str, Any]:
 
     def __init__(self, *,
                  logger: 'Logger',
-                 validate: bool,
+                 short_purls: bool,
                  output_format: OutputFormat,
                  schema_version: SchemaVersion,
+                 should_validate: bool,
                  _bbc: Type['BomBuilder'],
                  **kwargs: Any) -> None:
         self._logger = logger
+        self._short_purls = short_purls
         self._output_format = output_format
         self._schema_version = schema_version
-        self._validate = validate
+        self._should_validate = should_validate
         self._bbc = _bbc(**self._clean_kwargs(kwargs),
                          logger=self._logger.getChild(_bbc.__name__))
 
-    def validate(self, output: str) -> bool:
-        if not self._validate:
+    def _shorten_purls(self, bom: 'Bom') -> bool:
+        if not self._short_purls:
+            return False
+
+        from itertools import chain
+
+        self._logger.info('Shorting purls...')
+        component: 'Component'
+        for component in chain(
+            bom.metadata.component.get_all_nested_components(True) if bom.metadata.component else [],
+            chain.from_iterable(
+                component.get_all_nested_components(True) for component in bom.components
+            )
+        ):
+            if component.purl is not None:
+                component.purl = type(component.purl)(
+                    type=component.purl.type,  # type:ignore[arg-type]
+                    namespace=component.purl.namespace,  # type:ignore[arg-type]
+                    name=component.purl.name,  # type:ignore[arg-type]
+                    version=component.purl.version  # type:ignore[arg-type]
+                )
+        return True
+
+    def _validate(self, output: str) -> bool:
+        if not self._should_validate:
             self._logger.warning('Validation skipped.')
             return False
 
@@ -158,17 +191,17 @@ def validate(self, output: str) -> bool:
             self._logger.error('Please report the issue and provide all input data to: '
                                'https://github.com/CycloneDX/cyclonedx-python/issues/new?'
                                'template=ValidationError-report.md&labels=ValidationError&title=%5BValidationError%5D')
-            raise ValueError('Output is schema-invalid')
+            raise ValueError('result is schema-invalid')
         self._logger.info('Valid.')
         return True
 
-    def write(self, output: str, outfile: TextIO) -> int:
+    def _write(self, output: str, outfile: TextIO) -> int:
         self._logger.info('Writing to: %s', outfile.name)
         written = outfile.write(output)
         self._logger.info('Wrote %i bytes to %s', written, outfile.name)
         return written
 
-    def make_output(self, bom: 'Bom') -> str:
+    def _make_output(self, bom: 'Bom') -> str:
         self._logger.info('Serializing SBOM: %s/%s', self._schema_version.to_version(), self._output_format.name)
         from cyclonedx.output import make_outputter
 
@@ -178,16 +211,19 @@ def make_output(self, bom: 'Bom') -> str:
             self._schema_version
         ).output_as_string(indent=2)
 
-    def make_bom(self, **kwargs: Any) -> 'Bom':
+    def _make_bom(self, **kwargs: Any) -> 'Bom':
         self._logger.info('Generating SBOM ...')
         return self._bbc(**self._clean_kwargs(kwargs))
 
     def __call__(self,
                  outfile: TextIO,
                  **kwargs: Any) -> None:
-        output = self.make_output(self.make_bom(**kwargs))
-        self.validate(output)
-        self.write(output, outfile)
+        bom = self._make_bom(**kwargs)
+        self._shorten_purls(bom)
+        output = self._make_output(bom)
+        del bom
+        self._validate(output)
+        self._write(output, outfile)
 
 
 def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
@@ -212,9 +248,9 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
     lh.setFormatter(logging.Formatter('%(levelname)-8s | %(name)s > %(message)s'))
     logger = logging.getLogger('CDX')
     logger.propagate = False
-    logger.setLevel(ll)
+    logger.setLevel(lh.level)
     logger.addHandler(lh)
-    del ll
+
     logger.debug('args: %s', args)
 
     try:
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index cbaa459f..3ec2265e 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -126,7 +126,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         p.add_argument('--mc-type',
                        metavar='TYPE',
                        help='Type of the main component'
-                            f' {{choice: {", ".join(t.value for t in _mc_types)}}}'
+                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
                             ' (default: %(default)s)',
                        dest='mc_type',
                        choices=_mc_types,
diff --git a/cyclonedx_py/_internal/utils/args.py b/cyclonedx_py/_internal/utils/args.py
index 2eba3e8a..6edc9909 100644
--- a/cyclonedx_py/_internal/utils/args.py
+++ b/cyclonedx_py/_internal/utils/args.py
@@ -34,4 +34,4 @@ def str2case(value: str) -> _E:
 
 
 def choices4enum(enum: Type[Enum]) -> str:
-    return f' {{choice: {", ".join(sorted(c.name for c in enum))}}}'
+    return f'{{choices: {", ".join(sorted(c.name for c in enum))}}}'
diff --git a/tests/_data/snapshots/cli/purls-normal.json.bin b/tests/_data/snapshots/cli/purls-normal.json.bin
new file mode 100644
index 00000000..d4b06c1d
--- /dev/null
+++ b/tests/_data/snapshots/cli/purls-normal.json.bin
@@ -0,0 +1,81 @@
+{
+  "components": [
+    {
+      "bom-ref": "my-lib-A",
+      "components": [
+        {
+          "bom-ref": "my-lib-A-sub",
+          "name": "my-lib-A-sub",
+          "purl": "pkg:generic/testing/my-lib-A-sub?foo=bar#bazz",
+          "type": "application"
+        }
+      ],
+      "name": "my-lib-A",
+      "purl": "pkg:generic/testing/my-lib-A@2?lol=rofl",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "my-app"
+    },
+    {
+      "ref": "my-lib-A"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "my-app",
+      "name": "my-app",
+      "purl": "pkg:generic/testing/my-app@1",
+      "type": "application"
+    },
+    "timestamp": "2023-11-16T18:36:26.767746+00:00",
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "serialNumber": "urn:uuid:9e91c977-6030-43ff-9e8d-062ce627830b",
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/cli/purls-short.json.bin b/tests/_data/snapshots/cli/purls-short.json.bin
new file mode 100644
index 00000000..ed776a48
--- /dev/null
+++ b/tests/_data/snapshots/cli/purls-short.json.bin
@@ -0,0 +1,81 @@
+{
+  "components": [
+    {
+      "bom-ref": "my-lib-A",
+      "components": [
+        {
+          "bom-ref": "my-lib-A-sub",
+          "name": "my-lib-A-sub",
+          "purl": "pkg:generic/testing/my-lib-A-sub",
+          "type": "application"
+        }
+      ],
+      "name": "my-lib-A",
+      "purl": "pkg:generic/testing/my-lib-A@2",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "my-app"
+    },
+    {
+      "ref": "my-lib-A"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "my-app",
+      "name": "my-app",
+      "purl": "pkg:generic/testing/my-app@1",
+      "type": "application"
+    },
+    "timestamp": "2023-11-16T18:36:26.776733+00:00",
+    "tools": [
+      {
+        "externalReferences": [
+          {
+            "type": "build-system",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
+          },
+          {
+            "type": "distribution",
+            "url": "https://pypi.org/project/cyclonedx-python-lib/"
+          },
+          {
+            "type": "documentation",
+            "url": "https://cyclonedx-python-library.readthedocs.io/"
+          },
+          {
+            "type": "issue-tracker",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+          },
+          {
+            "type": "license",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
+          },
+          {
+            "type": "release-notes",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
+          },
+          {
+            "type": "vcs",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+          },
+          {
+            "type": "website",
+            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+          }
+        ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "serialNumber": "urn:uuid:53536fcb-778a-4a9c-ad6e-ef4e3ae8153b",
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/unit/__init__.py b/tests/unit/__init__.py
new file mode 100644
index 00000000..c2926fb2
--- /dev/null
+++ b/tests/unit/__init__.py
@@ -0,0 +1,16 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py
new file mode 100644
index 00000000..03335f1b
--- /dev/null
+++ b/tests/unit/test_cli.py
@@ -0,0 +1,158 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+import logging
+import unittest
+from io import StringIO
+from os.path import join
+from unittest import TestCase
+from unittest.mock import Mock
+
+from cyclonedx.model.bom import Bom
+from cyclonedx.model.component import Component, ComponentType
+from cyclonedx.schema import OutputFormat, SchemaVersion
+from ddt import ddt, named_data
+from packageurl import PackageURL
+
+from cyclonedx_py._internal import BomBuilder
+from cyclonedx_py._internal.cli import Command
+from tests import SnapshotMixin
+
+
+@ddt
+class TestCli(TestCase, SnapshotMixin):
+
+    @named_data(('normal', False), ('short', True))
+    def test_purls_as_expected(self, short_purls: bool) -> None:
+        bom = Bom()
+        bom.metadata.component = Component(
+            type=ComponentType.APPLICATION,
+            name='my-app',
+            bom_ref='my-app',
+            purl=PackageURL('generic', 'testing', 'my-app', '1', {})
+        )
+        bom.components.add(Component(
+            type=ComponentType.LIBRARY,
+            name='my-lib-A',
+            bom_ref='my-lib-A',
+            purl=PackageURL('generic', 'testing', 'my-lib-A', '2', {'lol': 'rofl'}),
+            components=[Component(
+                type=ComponentType.APPLICATION,
+                name='my-lib-A-sub',
+                bom_ref='my-lib-A-sub',
+                purl=PackageURL('generic', 'testing', 'my-lib-A-sub', None, 'foo=bar', 'bazz')
+            )]
+        ))
+
+        class MyBBC(BomBuilder):
+            def __new__(cls, *args, **kwargs) -> BomBuilder:
+                return Mock(spec=BomBuilder, return_value=bom)
+
+        with StringIO() as logs, StringIO() as outs:
+            logs.name = '<logstream>'
+            outs.name = '<outstream>'
+
+            logger = logging.getLogger('testing')
+            logger.propagate = False
+            lh = logging.StreamHandler(logs)
+            lh.setLevel(logger.level)
+            logger.addHandler(lh)
+
+            command = Command(
+                logger=logger,
+                short_purls=short_purls,
+                schema_version=SchemaVersion.V1_4,
+                output_format=OutputFormat.JSON,
+                should_validate=True,
+                _bbc=MyBBC
+            )
+            command(outfile=outs)
+
+            log = logs.getvalue()
+            out = outs.getvalue()
+
+        self.assertEqualSnapshot(out, f'purls-{"short" if short_purls else "normal"}.json')
+
+    def test_validation_throws_with_invalid(self) -> None:
+        class MyBBC(BomBuilder):
+            def __new__(cls, *args, **kwargs) -> BomBuilder:
+                return Mock(spec=BomBuilder, return_value=Mock(spec=Bom))
+
+        with StringIO() as logs, StringIO() as outs:
+            logs.name = '<logstream>'
+            outs.name = '<outstream>'
+
+            logger = logging.getLogger('testing')
+            logger.propagate = False
+            lh = logging.StreamHandler(logs)
+            lh.setLevel(logger.level)
+            logger.addHandler(lh)
+
+            command = Command(
+                logger=logger,
+                short_purls=False,
+                schema_version=SchemaVersion.V1_4,
+                output_format=OutputFormat.JSON,
+                should_validate=True,
+                _bbc=MyBBC
+            )
+            command._make_output = Mock(return_value='["invalid to CDX schema"]')
+
+            with self.assertRaisesRegex(ValueError, 'is schema-invalid'):
+                command(outfile=outs)
+
+            log = logs.getvalue()
+            out = outs.getvalue()
+
+    def test_validation_skip_with_invalid(self) -> None:
+        class MyBBC(BomBuilder):
+            def __new__(cls, *args, **kwargs) -> BomBuilder:
+                return Mock(spec=BomBuilder, return_value=Mock(spec=Bom))
+
+        with StringIO() as logs, StringIO() as outs:
+            logs.name = '<logstream>'
+            outs.name = '<outstream>'
+
+            logger = logging.getLogger('testing')
+            logger.level = logging.WARNING
+            logger.propagate = False
+            lh = logging.StreamHandler(logs)
+            lh.setFormatter(logging.Formatter('%(levelname)s: %(message)s'))
+            lh.setLevel(logger.level)
+            logger.addHandler(lh)
+
+            command = Command(
+                logger=logger,
+                short_purls=False,
+                schema_version=SchemaVersion.V1_4,
+                output_format=OutputFormat.JSON,
+                should_validate=False,
+                _bbc=MyBBC
+            )
+            command._make_output = Mock(return_value='["invalid to CDX schema"]')
+
+            command(outfile=outs)
+
+            log = logs.getvalue()
+            out = outs.getvalue()
+
+        self.assertEqual('["invalid to CDX schema"]', out)
+        self.assertIn('WARNING: Validation skipped', log)
+
+    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
+        super().assertEqualSnapshot(actual, join('cli', snapshot_name))

From d71ef21365c68c1c5f2170bd216fe62d16027778 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 16 Nov 2023 19:56:26 +0100
Subject: [PATCH 117/155] tidy

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/unit/test_cli.py | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py
index 03335f1b..5ea623cd 100644
--- a/tests/unit/test_cli.py
+++ b/tests/unit/test_cli.py
@@ -17,9 +17,9 @@
 
 
 import logging
-import unittest
 from io import StringIO
 from os.path import join
+from typing import Any
 from unittest import TestCase
 from unittest.mock import Mock
 
@@ -60,7 +60,7 @@ def test_purls_as_expected(self, short_purls: bool) -> None:
         ))
 
         class MyBBC(BomBuilder):
-            def __new__(cls, *args, **kwargs) -> BomBuilder:
+            def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
                 return Mock(spec=BomBuilder, return_value=bom)
 
         with StringIO() as logs, StringIO() as outs:
@@ -83,14 +83,13 @@ def __new__(cls, *args, **kwargs) -> BomBuilder:
             )
             command(outfile=outs)
 
-            log = logs.getvalue()
             out = outs.getvalue()
 
         self.assertEqualSnapshot(out, f'purls-{"short" if short_purls else "normal"}.json')
 
     def test_validation_throws_with_invalid(self) -> None:
         class MyBBC(BomBuilder):
-            def __new__(cls, *args, **kwargs) -> BomBuilder:
+            def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
                 return Mock(spec=BomBuilder, return_value=Mock(spec=Bom))
 
         with StringIO() as logs, StringIO() as outs:
@@ -116,12 +115,9 @@ def __new__(cls, *args, **kwargs) -> BomBuilder:
             with self.assertRaisesRegex(ValueError, 'is schema-invalid'):
                 command(outfile=outs)
 
-            log = logs.getvalue()
-            out = outs.getvalue()
-
     def test_validation_skip_with_invalid(self) -> None:
         class MyBBC(BomBuilder):
-            def __new__(cls, *args, **kwargs) -> BomBuilder:
+            def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
                 return Mock(spec=BomBuilder, return_value=Mock(spec=Bom))
 
         with StringIO() as logs, StringIO() as outs:
@@ -154,5 +150,5 @@ def __new__(cls, *args, **kwargs) -> BomBuilder:
         self.assertEqual('["invalid to CDX schema"]', out)
         self.assertIn('WARNING: Validation skipped', log)
 
-    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:
+    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa: N802
         super().assertEqualSnapshot(actual, join('cli', snapshot_name))

From 4cfc6d6c84fbfb7ddb5f02396e7edb4a06666d68 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 16 Nov 2023 20:00:45 +0100
Subject: [PATCH 118/155] fix tests

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../_data/snapshots/cli/purls-normal.json.bin | 45 +------------------
 .../_data/snapshots/cli/purls-short.json.bin  | 45 +------------------
 tests/unit/test_cli.py                        |  3 ++
 3 files changed, 5 insertions(+), 88 deletions(-)

diff --git a/tests/_data/snapshots/cli/purls-normal.json.bin b/tests/_data/snapshots/cli/purls-normal.json.bin
index d4b06c1d..f0ad7d50 100644
--- a/tests/_data/snapshots/cli/purls-normal.json.bin
+++ b/tests/_data/snapshots/cli/purls-normal.json.bin
@@ -29,51 +29,8 @@
       "name": "my-app",
       "purl": "pkg:generic/testing/my-app@1",
       "type": "application"
-    },
-    "timestamp": "2023-11-16T18:36:26.767746+00:00",
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.1.1"
-      }
-    ]
+    }
   },
-  "serialNumber": "urn:uuid:9e91c977-6030-43ff-9e8d-062ce627830b",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/_data/snapshots/cli/purls-short.json.bin b/tests/_data/snapshots/cli/purls-short.json.bin
index ed776a48..29fa367c 100644
--- a/tests/_data/snapshots/cli/purls-short.json.bin
+++ b/tests/_data/snapshots/cli/purls-short.json.bin
@@ -29,51 +29,8 @@
       "name": "my-app",
       "purl": "pkg:generic/testing/my-app@1",
       "type": "application"
-    },
-    "timestamp": "2023-11-16T18:36:26.776733+00:00",
-    "tools": [
-      {
-        "externalReferences": [
-          {
-            "type": "build-system",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
-          },
-          {
-            "type": "distribution",
-            "url": "https://pypi.org/project/cyclonedx-python-lib/"
-          },
-          {
-            "type": "documentation",
-            "url": "https://cyclonedx-python-library.readthedocs.io/"
-          },
-          {
-            "type": "issue-tracker",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
-          },
-          {
-            "type": "license",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
-          },
-          {
-            "type": "release-notes",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
-          },
-          {
-            "type": "vcs",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
-          },
-          {
-            "type": "website",
-            "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
-          }
-        ],
-        "name": "cyclonedx-python-lib",
-        "vendor": "CycloneDX",
-        "version": "5.1.1"
-      }
-    ]
+    }
   },
-  "serialNumber": "urn:uuid:53536fcb-778a-4a9c-ad6e-ef4e3ae8153b",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
   "bomFormat": "CycloneDX",
diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py
index 5ea623cd..04f8310c 100644
--- a/tests/unit/test_cli.py
+++ b/tests/unit/test_cli.py
@@ -58,6 +58,9 @@ def test_purls_as_expected(self, short_purls: bool) -> None:
                 purl=PackageURL('generic', 'testing', 'my-lib-A-sub', None, 'foo=bar', 'bazz')
             )]
         ))
+        bom.serial_number = None
+        bom.metadata.timestamp = None
+        bom.metadata.tools.clear()
 
         class MyBBC(BomBuilder):
             def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:

From f193c52672817cb14ec224a6a20cdb9875e181f2 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 16 Nov 2023 21:56:31 +0100
Subject: [PATCH 119/155] poetry alt repo

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              | 39 ++++++++++++-------
 .../poetry/private-packges-lock10-1.0.xml.bin |  4 +-
 .../poetry/private-packges-lock10-1.1.xml.bin |  4 +-
 .../private-packges-lock10-1.2.json.bin       |  4 +-
 .../poetry/private-packges-lock10-1.2.xml.bin |  4 +-
 .../private-packges-lock10-1.3.json.bin       |  4 +-
 .../poetry/private-packges-lock10-1.3.xml.bin |  4 +-
 .../private-packges-lock10-1.4.json.bin       |  4 +-
 .../poetry/private-packges-lock10-1.4.xml.bin |  4 +-
 .../poetry/private-packges-lock11-1.0.xml.bin | 18 ++++-----
 .../poetry/private-packges-lock11-1.1.xml.bin | 18 ++++-----
 .../private-packges-lock11-1.2.json.bin       | 18 ++++-----
 .../poetry/private-packges-lock11-1.2.xml.bin | 18 ++++-----
 .../private-packges-lock11-1.3.json.bin       | 18 ++++-----
 .../poetry/private-packges-lock11-1.3.xml.bin | 18 ++++-----
 .../private-packges-lock11-1.4.json.bin       | 18 ++++-----
 .../poetry/private-packges-lock11-1.4.xml.bin | 18 ++++-----
 .../poetry/private-packges-lock20-1.0.xml.bin | 18 ++++-----
 .../poetry/private-packges-lock20-1.1.xml.bin | 18 ++++-----
 .../private-packges-lock20-1.2.json.bin       | 18 ++++-----
 .../poetry/private-packges-lock20-1.2.xml.bin | 18 ++++-----
 .../private-packges-lock20-1.3.json.bin       | 18 ++++-----
 .../poetry/private-packges-lock20-1.3.xml.bin | 18 ++++-----
 .../private-packges-lock20-1.4.json.bin       | 18 ++++-----
 .../poetry/private-packges-lock20-1.4.xml.bin | 18 ++++-----
 25 files changed, 186 insertions(+), 173 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 3ec2265e..790e8823 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -409,18 +409,6 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
         is_vcs = source.get('type') in self.__PACKAGE_SRC_VCS
         is_local = source.get('type') in self.__PACKAGE_SRC_LOCAL
 
-        purl_qualifiers = {}  # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
-        if is_vcs:
-            # see section 3.7.4 in https://github.com/spdx/spdx-spec/blob/cfa1b9d08903/chapters/3-package-information.md
-            # > For version-controlled files, the VCS location syntax is similar to a URL and has the:
-            # > `<vcs_tool>+<transport>://<host_name>[/<path_to_repository>][@<revision_tag_or_branch>][#<sub_path>]`
-            purl_qualifiers['vcs_url'] = f'{source["type"]}+{source["url"]}@' +\
-                                         source.get('resolved_reference', source.get('reference', ''))
-        elif package['source'].get('type') == 'url':
-            if '://files.pythonhosted.org/' not in package['source']['url']:
-                # skip PURL bloat, do not add implicit information
-                purl_qualifiers['download_url'] = package['source']['url']
-
         return Component(
             bom_ref=f'{package["name"]}@{package["version"]}',
             name=package['name'],
@@ -445,10 +433,35 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
             purl=PackageURL(type='pypi',
                             name=package['name'],
                             version=package['version'],
-                            qualifiers=purl_qualifiers
+                            qualifiers=self.__purl_qualifiers4lock(package)
                             ) if not is_local else None
         )
 
+    def __purl_qualifiers4lock(self, package: 'NameDict') -> 'NameDict':
+        # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+        qs = dict()
+
+        source = package['source']
+        source_type = package['source'].get('type')
+
+        if source_type in self.__PACKAGE_SRC_VCS:
+            # see section 3.7.4 in https://github.com/spdx/spdx-spec/blob/cfa1b9d08903/chapters/3-package-information.md
+            # > For version-controlled files, the VCS location syntax is similar to a URL and has the:
+            # > `<vcs_tool>+<transport>://<host_name>[/<path_to_repository>][@<revision_tag_or_branch>][#<sub_path>]`
+            qs['vcs_url'] = f'{source["type"]}+{source["url"]}@' + \
+                source.get('resolved_reference', source.get('reference', ''))
+        elif source_type == 'url':
+            if '://files.pythonhosted.org/' not in package['source']['url']:
+                # skip PURL bloat, do not add implicit information
+                qs['download_url'] = package['source']['url']
+        elif source_type == 'legacy':
+            source_url = package['source'].get('url', 'https://pypi.org/simple')
+            if '://pypi.org/' not in source_url:
+                # skip PURL bloat, do not add implicit information
+                qs['repository_url'] = source_url
+
+        return qs
+
     def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
         source_type = package['source'].get('type', 'legacy')
         if 'legacy' == source_type:
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin
index efa54d7b..839a6717 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin
@@ -5,14 +5,14 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
index 79efaaca..e5bde160 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
@@ -5,7 +5,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -21,7 +21,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
index a2851e25..ac35187f 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
@@ -16,7 +16,7 @@
         }
       ],
       "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -36,7 +36,7 @@
         }
       ],
       "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
index d5a6d11c..877ca21a 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
@@ -25,7 +25,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -41,7 +41,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
index 0fd47c7e..1d664c74 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
@@ -34,7 +34,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -72,7 +72,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
index 10f12101..4adbdce1 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
@@ -25,7 +25,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -50,7 +50,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
index bbb42f12..324f4d69 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
@@ -34,7 +34,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -72,7 +72,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
index ade38990..5b428ba3 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
@@ -52,7 +52,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -77,7 +77,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin
index 55f6597d..19168963 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin
@@ -5,63 +5,63 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
index 4ee6c7c7..f21f1dab 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
@@ -5,7 +5,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -21,7 +21,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -37,7 +37,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -53,7 +53,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -129,7 +129,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -265,7 +265,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -281,7 +281,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -389,7 +389,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -405,7 +405,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
index 20fd312a..8adb838d 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
@@ -16,7 +16,7 @@
         }
       ],
       "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -36,7 +36,7 @@
         }
       ],
       "name": "importlib-metadata",
-      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "6.8.0"
     },
@@ -56,7 +56,7 @@
         }
       ],
       "name": "jax",
-      "purl": "pkg:pypi/jax@0.4.20",
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
       "type": "library",
       "version": "0.4.20"
     },
@@ -151,7 +151,7 @@
         }
       ],
       "name": "ml-dtypes",
-      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.3.1"
     },
@@ -321,7 +321,7 @@
         }
       ],
       "name": "numpy",
-      "purl": "pkg:pypi/numpy@1.26.1",
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.26.1"
     },
@@ -341,7 +341,7 @@
         }
       ],
       "name": "opt-einsum",
-      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.3.0"
     },
@@ -476,7 +476,7 @@
         }
       ],
       "name": "scipy",
-      "purl": "pkg:pypi/scipy@1.11.3",
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.11.3"
     },
@@ -496,7 +496,7 @@
         }
       ],
       "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     },
@@ -516,7 +516,7 @@
         }
       ],
       "name": "zipp",
-      "purl": "pkg:pypi/zipp@3.17.0",
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.17.0"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
index 1e15bbdd..bce30ce1 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
@@ -25,7 +25,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -41,7 +41,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -57,7 +57,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -73,7 +73,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -149,7 +149,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -285,7 +285,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -301,7 +301,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -409,7 +409,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -425,7 +425,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
index da65bf8b..d6851eeb 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
@@ -34,7 +34,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -72,7 +72,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "6.8.0"
     },
@@ -110,7 +110,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/jax@0.4.20",
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
       "type": "library",
       "version": "0.4.20"
     },
@@ -313,7 +313,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.3.1"
     },
@@ -681,7 +681,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/numpy@1.26.1",
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.26.1"
     },
@@ -719,7 +719,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.3.0"
     },
@@ -1010,7 +1010,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/scipy@1.11.3",
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.11.3"
     },
@@ -1048,7 +1048,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     },
@@ -1086,7 +1086,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/zipp@3.17.0",
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.17.0"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
index ac30ef5f..ff45af4a 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
@@ -25,7 +25,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -50,7 +50,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -75,7 +75,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -100,7 +100,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -230,7 +230,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -465,7 +465,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -490,7 +490,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -676,7 +676,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -701,7 +701,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
index 15cfd906..a582fcc9 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
@@ -34,7 +34,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -72,7 +72,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "6.8.0"
     },
@@ -110,7 +110,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/jax@0.4.20",
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
       "type": "library",
       "version": "0.4.20"
     },
@@ -313,7 +313,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.3.1"
     },
@@ -681,7 +681,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/numpy@1.26.1",
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.26.1"
     },
@@ -719,7 +719,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.3.0"
     },
@@ -1010,7 +1010,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/scipy@1.11.3",
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.11.3"
     },
@@ -1048,7 +1048,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     },
@@ -1086,7 +1086,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/zipp@3.17.0",
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.17.0"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
index 36ddfbeb..9ac75f7f 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
@@ -52,7 +52,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -77,7 +77,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -102,7 +102,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -127,7 +127,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -257,7 +257,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -492,7 +492,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -517,7 +517,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -703,7 +703,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -728,7 +728,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin
index 55f6597d..19168963 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin
@@ -5,63 +5,63 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <modified>false</modified>
     </component>
   </components>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
index 4ee6c7c7..f21f1dab 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
@@ -5,7 +5,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -21,7 +21,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -37,7 +37,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -53,7 +53,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -129,7 +129,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -265,7 +265,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -281,7 +281,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -389,7 +389,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -405,7 +405,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
index 20fd312a..8adb838d 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
@@ -16,7 +16,7 @@
         }
       ],
       "name": "colorama",
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -36,7 +36,7 @@
         }
       ],
       "name": "importlib-metadata",
-      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "6.8.0"
     },
@@ -56,7 +56,7 @@
         }
       ],
       "name": "jax",
-      "purl": "pkg:pypi/jax@0.4.20",
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
       "type": "library",
       "version": "0.4.20"
     },
@@ -151,7 +151,7 @@
         }
       ],
       "name": "ml-dtypes",
-      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.3.1"
     },
@@ -321,7 +321,7 @@
         }
       ],
       "name": "numpy",
-      "purl": "pkg:pypi/numpy@1.26.1",
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.26.1"
     },
@@ -341,7 +341,7 @@
         }
       ],
       "name": "opt-einsum",
-      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.3.0"
     },
@@ -476,7 +476,7 @@
         }
       ],
       "name": "scipy",
-      "purl": "pkg:pypi/scipy@1.11.3",
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.11.3"
     },
@@ -496,7 +496,7 @@
         }
       ],
       "name": "toml",
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     },
@@ -516,7 +516,7 @@
         }
       ],
       "name": "zipp",
-      "purl": "pkg:pypi/zipp@3.17.0",
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.17.0"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
index 1e15bbdd..bce30ce1 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
@@ -25,7 +25,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -41,7 +41,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -57,7 +57,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -73,7 +73,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -149,7 +149,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -285,7 +285,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -301,7 +301,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -409,7 +409,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -425,7 +425,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
index f62eeffb..25245cf7 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
@@ -34,7 +34,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -66,7 +66,7 @@
         }
       ],
       "name": "importlib-metadata",
-      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "6.8.0"
     },
@@ -104,7 +104,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/jax@0.4.20",
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
       "type": "library",
       "version": "0.4.20"
     },
@@ -301,7 +301,7 @@
         }
       ],
       "name": "ml-dtypes",
-      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.3.1"
     },
@@ -663,7 +663,7 @@
         }
       ],
       "name": "numpy",
-      "purl": "pkg:pypi/numpy@1.26.1",
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.26.1"
     },
@@ -695,7 +695,7 @@
         }
       ],
       "name": "opt-einsum",
-      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.3.0"
     },
@@ -980,7 +980,7 @@
         }
       ],
       "name": "scipy",
-      "purl": "pkg:pypi/scipy@1.11.3",
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.11.3"
     },
@@ -1018,7 +1018,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     },
@@ -1050,7 +1050,7 @@
         }
       ],
       "name": "zipp",
-      "purl": "pkg:pypi/zipp@3.17.0",
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.17.0"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
index b435f642..4088b214 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
@@ -25,7 +25,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -50,7 +50,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -72,7 +72,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -97,7 +97,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -224,7 +224,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -456,7 +456,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -478,7 +478,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -661,7 +661,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -686,7 +686,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
index 716cb60c..86b2b9b5 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
@@ -34,7 +34,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/colorama@0.4.6",
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.4.6"
     },
@@ -66,7 +66,7 @@
         }
       ],
       "name": "importlib-metadata",
-      "purl": "pkg:pypi/importlib-metadata@6.8.0",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "6.8.0"
     },
@@ -104,7 +104,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/jax@0.4.20",
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
       "type": "library",
       "version": "0.4.20"
     },
@@ -301,7 +301,7 @@
         }
       ],
       "name": "ml-dtypes",
-      "purl": "pkg:pypi/ml-dtypes@0.3.1",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "0.3.1"
     },
@@ -663,7 +663,7 @@
         }
       ],
       "name": "numpy",
-      "purl": "pkg:pypi/numpy@1.26.1",
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.26.1"
     },
@@ -695,7 +695,7 @@
         }
       ],
       "name": "opt-einsum",
-      "purl": "pkg:pypi/opt-einsum@3.3.0",
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.3.0"
     },
@@ -980,7 +980,7 @@
         }
       ],
       "name": "scipy",
-      "purl": "pkg:pypi/scipy@1.11.3",
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "1.11.3"
     },
@@ -1018,7 +1018,7 @@
           "value": "main"
         }
       ],
-      "purl": "pkg:pypi/toml@0.10.2",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
       "type": "library",
       "version": "0.10.2"
     },
@@ -1050,7 +1050,7 @@
         }
       ],
       "name": "zipp",
-      "purl": "pkg:pypi/zipp@3.17.0",
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
       "type": "library",
       "version": "3.17.0"
     }
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
index bc668092..1188876f 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
@@ -52,7 +52,7 @@
       <name>colorama</name>
       <version>0.4.6</version>
       <description>Cross-platform colored terminal text.</description>
-      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
@@ -77,7 +77,7 @@
       <name>importlib-metadata</name>
       <version>6.8.0</version>
       <description>Read metadata from Python packages</description>
-      <purl>pkg:pypi/importlib-metadata@6.8.0</purl>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
@@ -99,7 +99,7 @@
       <name>jax</name>
       <version>0.4.20</version>
       <description>Differentiate, compile, and transform Numpy code.</description>
-      <purl>pkg:pypi/jax@0.4.20</purl>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
@@ -124,7 +124,7 @@
       <name>ml-dtypes</name>
       <version>0.3.1</version>
       <description/>
-      <purl>pkg:pypi/ml-dtypes@0.3.1</purl>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
@@ -251,7 +251,7 @@
       <name>numpy</name>
       <version>1.26.1</version>
       <description>Fundamental package for array computing in Python</description>
-      <purl>pkg:pypi/numpy@1.26.1</purl>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -483,7 +483,7 @@
       <name>opt-einsum</name>
       <version>3.3.0</version>
       <description>Optimizing numpys einsum function</description>
-      <purl>pkg:pypi/opt-einsum@3.3.0</purl>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
@@ -505,7 +505,7 @@
       <name>scipy</name>
       <version>1.11.3</version>
       <description>Fundamental algorithms for scientific computing in Python</description>
-      <purl>pkg:pypi/scipy@1.11.3</purl>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
@@ -688,7 +688,7 @@
       <name>toml</name>
       <version>0.10.2</version>
       <description>Python Library for Tom's Obvious, Minimal Language</description>
-      <purl>pkg:pypi/toml@0.10.2</purl>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
@@ -713,7 +713,7 @@
       <name>zipp</name>
       <version>3.17.0</version>
       <description>Backport of pathlib-compatible object wrapper for zip files</description>
-      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
       <externalReferences>
         <reference type="distribution">
           <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>

From 182e5c7a125fa6b711e135c62a7210078eb25ac6 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 11:59:09 +0100
Subject: [PATCH 120/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 790e8823..99b80d4f 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -451,9 +451,9 @@ def __purl_qualifiers4lock(self, package: 'NameDict') -> 'NameDict':
             qs['vcs_url'] = f'{source["type"]}+{source["url"]}@' + \
                 source.get('resolved_reference', source.get('reference', ''))
         elif source_type == 'url':
-            if '://files.pythonhosted.org/' not in package['source']['url']:
+            if '://files.pythonhosted.org/' not in source['url']:
                 # skip PURL bloat, do not add implicit information
-                qs['download_url'] = package['source']['url']
+                qs['download_url'] = source['url']
         elif source_type == 'legacy':
             source_url = package['source'].get('url', 'https://pypi.org/simple')
             if '://pypi.org/' not in source_url:

From 9fe5f4a61eef213d8fff109ac54f445702a4f2ae Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 12:33:53 +0100
Subject: [PATCH 121/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/unit/test_cli.py | 39 ++++++++++++++++-----------------------
 1 file changed, 16 insertions(+), 23 deletions(-)

diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py
index 04f8310c..7d73ffec 100644
--- a/tests/unit/test_cli.py
+++ b/tests/unit/test_cli.py
@@ -19,6 +19,7 @@
 import logging
 from io import StringIO
 from os.path import join
+from random import randbytes
 from typing import Any
 from unittest import TestCase
 from unittest.mock import Mock
@@ -70,14 +71,8 @@ def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
             logs.name = '<logstream>'
             outs.name = '<outstream>'
 
-            logger = logging.getLogger('testing')
-            logger.propagate = False
-            lh = logging.StreamHandler(logs)
-            lh.setLevel(logger.level)
-            logger.addHandler(lh)
-
             command = Command(
-                logger=logger,
+                logger=self.__make_fresh_logger(logs),
                 short_purls=short_purls,
                 schema_version=SchemaVersion.V1_4,
                 output_format=OutputFormat.JSON,
@@ -99,14 +94,8 @@ def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
             logs.name = '<logstream>'
             outs.name = '<outstream>'
 
-            logger = logging.getLogger('testing')
-            logger.propagate = False
-            lh = logging.StreamHandler(logs)
-            lh.setLevel(logger.level)
-            logger.addHandler(lh)
-
             command = Command(
-                logger=logger,
+                logger=self.__make_fresh_logger(logs),
                 short_purls=False,
                 schema_version=SchemaVersion.V1_4,
                 output_format=OutputFormat.JSON,
@@ -127,16 +116,8 @@ def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
             logs.name = '<logstream>'
             outs.name = '<outstream>'
 
-            logger = logging.getLogger('testing')
-            logger.level = logging.WARNING
-            logger.propagate = False
-            lh = logging.StreamHandler(logs)
-            lh.setFormatter(logging.Formatter('%(levelname)s: %(message)s'))
-            lh.setLevel(logger.level)
-            logger.addHandler(lh)
-
             command = Command(
-                logger=logger,
+                logger=self.__make_fresh_logger(logs, logging.WARNING),
                 short_purls=False,
                 schema_version=SchemaVersion.V1_4,
                 output_format=OutputFormat.JSON,
@@ -155,3 +136,15 @@ def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
 
     def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa: N802
         super().assertEqualSnapshot(actual, join('cli', snapshot_name))
+
+    @classmethod
+    def __make_fresh_logger(cls, logstream: StringIO, level: int = logging.NOTSET) -> logging.Logger:
+        logger = logging.getLogger(f'{cls.__qualname__}.{randbytes(15).hex()}')
+        map(logger.removeHandler, logger.handlers)
+        logger.level = level
+        logger.propagate = False
+        lh = logging.StreamHandler(logstream)
+        lh.setLevel(logger.level)
+        lh.setFormatter(logging.Formatter('%(levelname)s: %(message)s'))
+        logger.addHandler(lh)
+        return logger

From 38bfcddaf0bdfa5cde3cef13ad3487f8cffa9a3e Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 13:28:41 +0100
Subject: [PATCH 122/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              |  15 +-
 .../poetry/no-dev-lock11-1.0.xml.bin          |  12 +
 .../poetry/no-dev-lock11-1.1.xml.bin          |  21 ++
 .../poetry/no-dev-lock11-1.2.json.bin         |  61 +++++
 .../poetry/no-dev-lock11-1.2.xml.bin          |  47 ++++
 .../poetry/no-dev-lock11-1.3.json.bin         |  79 ++++++
 .../poetry/no-dev-lock11-1.3.xml.bin          |  56 ++++
 .../poetry/no-dev-lock11-1.4.json.bin         |  75 +++++
 .../poetry/no-dev-lock11-1.4.xml.bin          |  83 ++++++
 .../poetry/no-dev-lock20-1.0.xml.bin          |  12 +
 .../poetry/no-dev-lock20-1.1.xml.bin          |  21 ++
 .../poetry/no-dev-lock20-1.2.json.bin         |  61 +++++
 .../poetry/no-dev-lock20-1.2.xml.bin          |  47 ++++
 .../poetry/no-dev-lock20-1.3.json.bin         |  79 ++++++
 .../poetry/no-dev-lock20-1.3.xml.bin          |  56 ++++
 .../poetry/no-dev-lock20-1.4.json.bin         |  75 +++++
 .../poetry/no-dev-lock20-1.4.xml.bin          |  83 ++++++
 .../poetry/only-groups-lock11-1.0.xml.bin     |  40 +++
 .../poetry/only-groups-lock11-1.1.xml.bin     |  85 ++++++
 .../poetry/only-groups-lock11-1.2.json.bin    | 163 +++++++++++
 .../poetry/only-groups-lock11-1.2.xml.bin     | 122 +++++++++
 .../poetry/only-groups-lock11-1.3.json.bin    | 257 ++++++++++++++++++
 .../poetry/only-groups-lock11-1.3.xml.bin     | 168 ++++++++++++
 .../poetry/only-groups-lock11-1.4.json.bin    | 253 +++++++++++++++++
 .../poetry/only-groups-lock11-1.4.xml.bin     | 195 +++++++++++++
 .../poetry/only-groups-lock20-1.0.xml.bin     |  40 +++
 .../poetry/only-groups-lock20-1.1.xml.bin     |  85 ++++++
 .../poetry/only-groups-lock20-1.2.json.bin    | 163 +++++++++++
 .../poetry/only-groups-lock20-1.2.xml.bin     | 122 +++++++++
 .../poetry/only-groups-lock20-1.3.json.bin    | 229 ++++++++++++++++
 .../poetry/only-groups-lock20-1.3.xml.bin     | 155 +++++++++++
 .../poetry/only-groups-lock20-1.4.json.bin    | 225 +++++++++++++++
 .../poetry/only-groups-lock20-1.4.xml.bin     | 182 +++++++++++++
 .../poetry/some-extras-lock20-1.0.xml.bin     |   8 +
 .../poetry/some-extras-lock20-1.1.xml.bin     |  17 ++
 .../poetry/some-extras-lock20-1.2.json.bin    |  27 ++
 .../poetry/some-extras-lock20-1.2.xml.bin     |  22 +-
 .../poetry/some-extras-lock20-1.3.json.bin    |  39 +++
 .../poetry/some-extras-lock20-1.3.xml.bin     |  28 +-
 .../poetry/some-extras-lock20-1.4.json.bin    |  39 +++
 .../poetry/some-extras-lock20-1.4.xml.bin     |  28 +-
 tests/integration/test_poetry.py              |  42 +++
 42 files changed, 3612 insertions(+), 5 deletions(-)
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.4.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.4.xml.bin

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 99b80d4f..de9a69f3 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -17,7 +17,7 @@
 
 
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, Optional, Set
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, Optional, Set, Tuple
 
 from . import BomBuilder
 
@@ -260,10 +260,15 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         _dep_pattern = re_compile(r'^(?P<name>[^\[]+)(?:\[(?P<extras>.*)\])?$')
 
+        lock_version = self._getLockfile_version(locker)
+        should_tidy_lock_names = lock_version >= (2,)
+
         def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
             name = name.lower()
             if name == 'python':
                 return None
+            if should_tidy_lock_names:
+                name = name.replace('.', '-')
             le = lock_data.get(name)
             if le is None:
                 self._logger.warning('skip unlocked component: %s', name)
@@ -304,6 +309,8 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
             self._logger.debug('processing group %r ...', group_name)
             for dep_name, dep_spec in po_cfg['group'][group_name].get('dependencies', {}).items():
                 dep_name = dep_name.lower()
+                if should_tidy_lock_names:
+                    dep_name = dep_name.replace('.', '-')
                 self._logger.debug('root-component depends on %s', dep_name)
                 if dep_name == 'python':
                     continue
@@ -360,11 +367,15 @@ def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') ->
                 pass
         return comp
 
+    @staticmethod
+    def _getLockfile_version(locker: 'NameDict') -> Tuple[int, ...]:
+        return tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
+
     def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
         locker.setdefault('metavar', {})
         locker.setdefault('package', [])
 
-        lock_version = tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
+        lock_version = self._getLockfile_version(locker)
         self._logger.debug('lock_version: %r', lock_version)
 
         metavar_files = locker['metadata'].get('files', {}) if lock_version < (2,) else {}
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.0.xml.bin
new file mode 100644
index 00000000..2316393a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.1.xml.bin
new file mode 100644
index 00000000..bbbd21b3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.1.xml.bin
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin
new file mode 100644
index 00000000..4df4eaa9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin
@@ -0,0 +1,61 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin
new file mode 100644
index 00000000..6c42d4dd
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin
new file mode 100644
index 00000000..1b5aa9a2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin
@@ -0,0 +1,79 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin
new file mode 100644
index 00000000..8f0da161
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin
@@ -0,0 +1,56 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.4.json.bin
new file mode 100644
index 00000000..dae2642f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.4.json.bin
@@ -0,0 +1,75 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.4.xml.bin
new file mode 100644
index 00000000..35cae920
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.4.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.0.xml.bin
new file mode 100644
index 00000000..2316393a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.1.xml.bin
new file mode 100644
index 00000000..bbbd21b3
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.1.xml.bin
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin
new file mode 100644
index 00000000..4df4eaa9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin
@@ -0,0 +1,61 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin
new file mode 100644
index 00000000..6c42d4dd
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin
new file mode 100644
index 00000000..1b5aa9a2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin
@@ -0,0 +1,79 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin
new file mode 100644
index 00000000..8f0da161
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin
@@ -0,0 +1,56 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.4.json.bin
new file mode 100644
index 00000000..dae2642f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.4.json.bin
@@ -0,0 +1,75 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.4.xml.bin
new file mode 100644
index 00000000..35cae920
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.4.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.0.xml.bin
new file mode 100644
index 00000000..d5ac3ec7
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.0.xml.bin
@@ -0,0 +1,40 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.1.xml.bin
new file mode 100644
index 00000000..afc1ad79
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.1.xml.bin
@@ -0,0 +1,85 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin
new file mode 100644
index 00000000..987ed988
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin
@@ -0,0 +1,163 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin
new file mode 100644
index 00000000..90eddc07
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin
@@ -0,0 +1,122 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin
new file mode 100644
index 00000000..51178e64
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin
@@ -0,0 +1,257 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin
new file mode 100644
index 00000000..6265da07
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin
@@ -0,0 +1,168 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.4.json.bin
new file mode 100644
index 00000000..13c87910
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.4.json.bin
@@ -0,0 +1,253 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.4.xml.bin
new file mode 100644
index 00000000..7e917955
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.4.xml.bin
@@ -0,0 +1,195 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.0.xml.bin
new file mode 100644
index 00000000..d5ac3ec7
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.0.xml.bin
@@ -0,0 +1,40 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.1.xml.bin
new file mode 100644
index 00000000..afc1ad79
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.1.xml.bin
@@ -0,0 +1,85 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin
new file mode 100644
index 00000000..987ed988
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin
@@ -0,0 +1,163 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin
new file mode 100644
index 00000000..90eddc07
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin
@@ -0,0 +1,122 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin
new file mode 100644
index 00000000..81583c02
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin
@@ -0,0 +1,229 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin
new file mode 100644
index 00000000..5674b2a1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin
@@ -0,0 +1,155 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.4.json.bin
new file mode 100644
index 00000000..d1c6ce92
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.4.json.bin
@@ -0,0 +1,225 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.4.xml.bin
new file mode 100644
index 00000000..752faa43
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.4.xml.bin
@@ -0,0 +1,182 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin
index c5d1e4cf..1d56ec37 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin
@@ -17,6 +17,14 @@
       <purl>pkg:pypi/attrs@23.1.0</purl>
       <modified>false</modified>
     </component>
+    <component type="library">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <modified>false</modified>
+    </component>
     <component type="library">
       <name>cyclonedx-python-lib</name>
       <version>5.1.1</version>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
index acd2229e..9a40829b 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
@@ -35,6 +35,23 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
       <name>cyclonedx-python-lib</name>
       <version>5.1.1</version>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
index 13c97c2d..d21db125 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
@@ -42,6 +42,27 @@
       "type": "library",
       "version": "23.1.0"
     },
+    {
+      "bom-ref": "boolean-py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz"
+        }
+      ],
+      "name": "boolean-py",
+      "purl": "pkg:pypi/boolean-py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
     {
       "bom-ref": "cyclonedx-python-lib@5.1.1",
       "description": "Python library for CycloneDX",
@@ -1514,6 +1535,9 @@
     {
       "ref": "attrs@23.1.0"
     },
+    {
+      "ref": "boolean-py@4.0"
+    },
     {
       "dependsOn": [
         "jsonschema@4.19.2",
@@ -1576,6 +1600,9 @@
       "ref": "jsonschema@4.19.2"
     },
     {
+      "dependsOn": [
+        "boolean-py@4.0"
+      ],
       "ref": "license-expression@30.1.1"
     },
     {
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
index 4b9d6050..747b3d2b 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
@@ -55,6 +55,23 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
       <name>cyclonedx-python-lib</name>
       <version>5.1.1</version>
@@ -1235,6 +1252,7 @@
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
     <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean-py@4.0"/>
     <dependency ref="cyclonedx-python-lib@5.1.1">
       <dependency ref="jsonschema@4.19.2"/>
       <dependency ref="license-expression@30.1.1"/>
@@ -1273,7 +1291,9 @@
       <dependency ref="uri-template@1.3.0"/>
       <dependency ref="webcolors@1.13"/>
     </dependency>
-    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean-py@4.0"/>
+    </dependency>
     <dependency ref="lxml@4.9.3"/>
     <dependency ref="packageurl-python@0.11.2"/>
     <dependency ref="pkgutil-resolve-name@1.3.10"/>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
index 2c36e7a1..ffb77f72 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
@@ -66,6 +66,39 @@
       "type": "library",
       "version": "23.1.0"
     },
+    {
+      "bom-ref": "boolean-py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz"
+        }
+      ],
+      "name": "boolean-py",
+      "purl": "pkg:pypi/boolean-py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
     {
       "bom-ref": "cyclonedx-python-lib@5.1.1",
       "description": "Python library for CycloneDX",
@@ -2980,6 +3013,9 @@
     {
       "ref": "attrs@23.1.0"
     },
+    {
+      "ref": "boolean-py@4.0"
+    },
     {
       "dependsOn": [
         "jsonschema@4.19.2",
@@ -3042,6 +3078,9 @@
       "ref": "jsonschema@4.19.2"
     },
     {
+      "dependsOn": [
+        "boolean-py@4.0"
+      ],
       "ref": "license-expression@30.1.1"
     },
     {
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
index 50047ebd..9b11be66 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
@@ -70,6 +70,29 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
       <name>cyclonedx-python-lib</name>
       <version>5.1.1</version>
@@ -1969,6 +1992,7 @@
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
     <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean-py@4.0"/>
     <dependency ref="cyclonedx-python-lib@5.1.1">
       <dependency ref="jsonschema@4.19.2"/>
       <dependency ref="license-expression@30.1.1"/>
@@ -2007,7 +2031,9 @@
       <dependency ref="uri-template@1.3.0"/>
       <dependency ref="webcolors@1.13"/>
     </dependency>
-    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean-py@4.0"/>
+    </dependency>
     <dependency ref="lxml@4.9.3"/>
     <dependency ref="packageurl-python@0.11.2"/>
     <dependency ref="pkgutil-resolve-name@1.3.10"/>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
index d9e79e34..c709f4a1 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
@@ -66,6 +66,39 @@
       "type": "library",
       "version": "23.1.0"
     },
+    {
+      "bom-ref": "boolean-py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz"
+        }
+      ],
+      "name": "boolean-py",
+      "purl": "pkg:pypi/boolean-py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
     {
       "bom-ref": "cyclonedx-python-lib@5.1.1",
       "description": "Python library for CycloneDX",
@@ -2980,6 +3013,9 @@
     {
       "ref": "attrs@23.1.0"
     },
+    {
+      "ref": "boolean-py@4.0"
+    },
     {
       "dependsOn": [
         "jsonschema@4.19.2",
@@ -3042,6 +3078,9 @@
       "ref": "jsonschema@4.19.2"
     },
     {
+      "dependsOn": [
+        "boolean-py@4.0"
+      ],
       "ref": "license-expression@30.1.1"
     },
     {
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
index fd85064b..36fdc525 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
@@ -97,6 +97,29 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
       <name>cyclonedx-python-lib</name>
       <version>5.1.1</version>
@@ -1996,6 +2019,7 @@
       <dependency ref="types-python-dateutil@2.8.19.14"/>
     </dependency>
     <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean-py@4.0"/>
     <dependency ref="cyclonedx-python-lib@5.1.1">
       <dependency ref="jsonschema@4.19.2"/>
       <dependency ref="license-expression@30.1.1"/>
@@ -2034,7 +2058,9 @@
       <dependency ref="uri-template@1.3.0"/>
       <dependency ref="webcolors@1.13"/>
     </dependency>
-    <dependency ref="license-expression@30.1.1"/>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean-py@4.0"/>
+    </dependency>
     <dependency ref="lxml@4.9.3"/>
     <dependency ref="packageurl-python@0.11.2"/>
     <dependency ref="pkgutil-resolve-name@1.3.10"/>
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 23170bc8..512fa279 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -164,6 +164,48 @@ def test_cli_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, o
             make_comparable(out, of),
             f'some-groups-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
 
+    @named_data(*test_data_file_filter('group-deps'))
+    def test_cli_only_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    '--only', 'groupB',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'only-groups-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+
+    @named_data(*test_data_file_filter('group-deps'))
+    def test_cli_nodev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'poetry',
+                    '-vvv',
+                    '--no-dev',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'no-dev-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+
     @named_data(*test_data_file_filter('with-extras'))
     def test_cli_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:

From 6fd27fb4dff0e5eadfe5d48cce7d531f8e5e7479 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 14:39:47 +0100
Subject: [PATCH 123/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              | 64 +++++++++------
 pyproject.toml                                |  1 +
 .../infiles/poetry/no-deps/lock20/poetry.lock |  7 ++
 .../poetry/no-deps/lock20/pyproject.toml      |  1 +
 .../poetry/no-deps/pyproject-proto.toml       | 22 ++++++
 .../poetry/no-deps-lock20-1.0.xml.bin         |  4 +
 .../poetry/no-deps-lock20-1.1.xml.bin         |  4 +
 .../poetry/no-deps-lock20-1.2.json.bin        | 65 +++++++++++++++
 .../poetry/no-deps-lock20-1.2.xml.bin         | 52 ++++++++++++
 .../poetry/no-deps-lock20-1.3.json.bin        | 65 +++++++++++++++
 .../poetry/no-deps-lock20-1.3.xml.bin         | 52 ++++++++++++
 .../poetry/no-deps-lock20-1.4.json.bin        | 61 ++++++++++++++
 .../poetry/no-deps-lock20-1.4.xml.bin         | 79 +++++++++++++++++++
 13 files changed, 451 insertions(+), 26 deletions(-)
 create mode 100644 tests/_data/infiles/poetry/no-deps/lock20/poetry.lock
 create mode 120000 tests/_data/infiles/poetry/no-deps/lock20/pyproject.toml
 create mode 100644 tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.0.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.1.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index de9a69f3..9031e517 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,6 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+import re
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, Optional, Set, Tuple
 
@@ -260,7 +261,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         _dep_pattern = re_compile(r'^(?P<name>[^\[]+)(?:\[(?P<extras>.*)\])?$')
 
-        lock_version = self._getLockfile_version(locker)
+        lock_version = self._get_lockfile_version(locker)
         should_tidy_lock_names = lock_version >= (2,)
 
         def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
@@ -331,13 +332,11 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
         return bom
 
     def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') -> 'Component':
-        from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.factory.license import LicenseFactory
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
         from cyclonedx.model.component import Component
 
         # see spec: https://python-poetry.org/docs/pyproject/
-        comp = Component(
+        return Component(
             bom_ref=str(po_cfg.get('name', 'root-component')),
             type=c_type,
             name=str(po_cfg.get('name', 'unnamed')),
@@ -345,37 +344,62 @@ def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') ->
             description=str(po_cfg.get('description', '')) or None,
             licenses=[LicenseFactory().make_from_string(po_cfg['license'])] if 'license' in po_cfg else None,
             author=' | '.join(po_cfg['authors']) if 'authors' in po_cfg else None,
+            external_references=self.__extrefs4poetryproj(po_cfg)
         )
+
+    def __extrefs4poetryproj(self, po_cfg: 'NameDict') -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+
         for ers, ert in [
+            # see https://python-poetry.org/docs/pyproject/
             ('homepage', ExternalReferenceType.WEBSITE),
             ('repository', ExternalReferenceType.VCS),
             ('documentation', ExternalReferenceType.DOCUMENTATION),
         ]:
             try:
-                ExternalReference(type=ert, url=XsUri(str(po_cfg[ers])))
-            except (KeyError, InvalidUriException):
+                yield ExternalReference(
+                    comment=f'project metadata: {ers}',
+                    type=ert,
+                    url=XsUri(str(po_cfg[ers])))
+            except (KeyError, InvalidUriException):  # pragma: nocover
                 pass
         known_ulr_names = {
-            'bug tracker': ExternalReferenceType.ISSUE_TRACKER,
-            'issue tracker': ExternalReferenceType.ISSUE_TRACKER,
+            # see https://peps.python.org/pep-0345/#project-url-multiple-use
+            # see https://github.com/pypi/warehouse/issues/5947#issuecomment-699660629
+            'bugtracker': ExternalReferenceType.ISSUE_TRACKER,
+            'issuetracker': ExternalReferenceType.ISSUE_TRACKER,
+            'issues': ExternalReferenceType.ISSUE_TRACKER,
+            'tracker': ExternalReferenceType.ISSUE_TRACKER,
+            'homepage': ExternalReferenceType.WEBSITE,
+            'download': ExternalReferenceType.DISTRIBUTION,
+            'documentation': ExternalReferenceType.DOCUMENTATION,
+            'docs': ExternalReferenceType.DOCUMENTATION,
+            # 'changelog': ExternalReferenceType.RELEASE_NOTES, # not available in all versions of CycloneDX
+            'changes': ExternalReferenceType.RELEASE_NOTES,
+            'repository': ExternalReferenceType.VCS,
+            'github': ExternalReferenceType.VCS,
+            'chat': ExternalReferenceType.CHAT,
         }
+        re_nochar = re.compile('[^a-z]')
         for un, ul in po_cfg.get('urls', {}).items():
             try:
-                ExternalReference(type=known_ulr_names.get(un.lower(), ExternalReferenceType.OTHER),
-                                  url=XsUri(str(ul)), comment=un)
-            except InvalidUriException:
+                yield ExternalReference(
+                    comment=f'package urls: {un}',
+                    type=known_ulr_names.get(re_nochar.sub('', str(un).lower()), ExternalReferenceType.OTHER),
+                    url=XsUri(str(ul)))
+            except InvalidUriException:  # pragma: nocover
                 pass
-        return comp
 
     @staticmethod
-    def _getLockfile_version(locker: 'NameDict') -> Tuple[int, ...]:
+    def _get_lockfile_version(locker: 'NameDict') -> Tuple[int, ...]:
         return tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
 
     def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
         locker.setdefault('metavar', {})
         locker.setdefault('package', [])
 
-        lock_version = self._getLockfile_version(locker)
+        lock_version = self._get_lockfile_version(locker)
         self._logger.debug('lock_version: %r', lock_version)
 
         metavar_files = locker['metadata'].get('files', {}) if lock_version < (2,) else {}
@@ -394,18 +418,6 @@ def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
                 added2bom_extras=set()
             )
 
-    def __hashes4file(self, files: List['NameDict']) -> Generator['HashType', None, None]:
-        from cyclonedx.exception.model import UnknownHashTypeException
-        from cyclonedx.model import HashType
-
-        for file in files:
-            if 'hash' in file:
-                try:
-                    yield HashType.from_composite_str(file['hash'])
-                except UnknownHashTypeException as error:
-                    self._logger.debug('skipping hash %s', file['hash'], exc_info=error)
-                    del error
-
     __PACKAGE_SRC_VCS = ['git']  # not supported yet: hg, svn
     __PACKAGE_SRC_LOCAL = ['file', 'directory']
 
diff --git a/pyproject.toml b/pyproject.toml
index eb23af98..381d04a9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -43,6 +43,7 @@ classifiers = [
 ]
 [tool.poetry.urls]
 "Bug Tracker" = "https://github.com/CycloneDX/cyclonedx-python/issues"
+"Funding" = "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
 
 [tool.poetry.dependencies]
 python = "^3.8"
diff --git a/tests/_data/infiles/poetry/no-deps/lock20/poetry.lock b/tests/_data/infiles/poetry/no-deps/lock20/poetry.lock
new file mode 100644
index 00000000..da22ac15
--- /dev/null
+++ b/tests/_data/infiles/poetry/no-deps/lock20/poetry.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+package = []
+
+[metadata]
+lock-version = "2.0"
+python-versions = "*"
+content-hash = "29c1d764c213c1f51fb6bcfa0fe43f351248fae4d4d20a20ade46059d3b7be05"
diff --git a/tests/_data/infiles/poetry/no-deps/lock20/pyproject.toml b/tests/_data/infiles/poetry/no-deps/lock20/pyproject.toml
new file mode 120000
index 00000000..060072be
--- /dev/null
+++ b/tests/_data/infiles/poetry/no-deps/lock20/pyproject.toml
@@ -0,0 +1 @@
+../pyproject-proto.toml
\ No newline at end of file
diff --git a/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
new file mode 100644
index 00000000..76ccc951
--- /dev/null
+++ b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
@@ -0,0 +1,22 @@
+[tool.poetry]
+name = "no-deps"
+version = "0.1.0"
+description = "packages with all meta, but no deps"
+authors = ["Your Name <you@example.com>", "My Name"]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+
+[tool.poetry.urls]
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
+
+
+[tool.poetry.dependencies]
+python = "*"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.0.xml.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.0.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.1.xml.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.1.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
new file mode 100644
index 00000000..d9c0f850
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
@@ -0,0 +1,65 @@
+{
+  "dependencies": [
+    {
+      "ref": "no-deps"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com> | My Name",
+      "bom-ref": "no-deps",
+      "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "project metadata: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "package urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "package urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "package urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "project metadata: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "project metadata: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
new file mode 100644
index 00000000..21c1e47c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
@@ -0,0 +1,52 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="no-deps">
+      <author>Your Name &lt;you@example.com&gt; | My Name</author>
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>project metadata: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>package urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package urls: Change log</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>package urls: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>project metadata: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>project metadata: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="no-deps"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
new file mode 100644
index 00000000..ee6a6f59
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
@@ -0,0 +1,65 @@
+{
+  "dependencies": [
+    {
+      "ref": "no-deps"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com> | My Name",
+      "bom-ref": "no-deps",
+      "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "project metadata: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "package urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "package urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "package urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "project metadata: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "project metadata: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "5.1.1"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
new file mode 100644
index 00000000..b9242e70
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
@@ -0,0 +1,52 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>5.1.1</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="no-deps">
+      <author>Your Name &lt;you@example.com&gt; | My Name</author>
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>project metadata: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>package urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package urls: Change log</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>package urls: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>project metadata: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>project metadata: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="no-deps"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
new file mode 100644
index 00000000..01dd465d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
@@ -0,0 +1,61 @@
+{
+  "dependencies": [
+    {
+      "ref": "no-deps"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com> | My Name",
+      "bom-ref": "no-deps",
+      "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "project metadata: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "package urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "package urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "package urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "project metadata: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "project metadata: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
new file mode 100644
index 00000000..ecaadb96
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
@@ -0,0 +1,79 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="no-deps">
+      <author>Your Name &lt;you@example.com&gt; | My Name</author>
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>project metadata: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>package urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package urls: Change log</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>package urls: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>project metadata: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>project metadata: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="no-deps"/>
+  </dependencies>
+</bom>

From 43ee9d926cb686839e266c3f5f94101090c67edd Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 14:54:09 +0100
Subject: [PATCH 124/155] requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py        |  1 +
 .../infiles/requirements/with-hashes.txt      |  8 +++--
 .../with-hashes.txt-1.0.xml-file.bin          |  9 ++++-
 .../with-hashes.txt-1.0.xml-stream.bin        |  9 ++++-
 .../with-hashes.txt-1.1.xml-file.bin          | 16 +++++++--
 .../with-hashes.txt-1.1.xml-stream.bin        | 16 +++++++--
 .../with-hashes.txt-1.2.json-file.bin         | 24 +++++++++++--
 .../with-hashes.txt-1.2.json-stream.bin       | 24 +++++++++++--
 .../with-hashes.txt-1.2.xml-file.bin          | 19 +++++++++--
 .../with-hashes.txt-1.2.xml-stream.bin        | 19 +++++++++--
 .../with-hashes.txt-1.3.json-file.bin         | 34 +++++++++++++++++--
 .../with-hashes.txt-1.3.json-stream.bin       | 34 +++++++++++++++++--
 .../with-hashes.txt-1.3.xml-file.bin          | 23 +++++++++++--
 .../with-hashes.txt-1.3.xml-stream.bin        | 23 +++++++++++--
 .../with-hashes.txt-1.4.json-file.bin         | 34 +++++++++++++++++--
 .../with-hashes.txt-1.4.json-stream.bin       | 34 +++++++++++++++++--
 .../with-hashes.txt-1.4.xml-file.bin          | 23 +++++++++++--
 .../with-hashes.txt-1.4.xml-stream.bin        | 23 +++++++++++--
 18 files changed, 329 insertions(+), 44 deletions(-)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 4716f781..48b0930d 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -195,6 +195,7 @@ def _make_component(self, req: 'InstallRequirement',
         except InvalidUriException as error:
             self._logger.debug('failed ExternalReference/url URL for: %s', req.line, exc_info=error)
             del error
+
         return Component(
             bom_ref=f'requirements-L{req.line_number}',
             description=f'requirements line {req.line_number}: {req.line}',
diff --git a/tests/_data/infiles/requirements/with-hashes.txt b/tests/_data/infiles/requirements/with-hashes.txt
index 4062b8b5..a4bac967 100644
--- a/tests/_data/infiles/requirements/with-hashes.txt
+++ b/tests/_data/infiles/requirements/with-hashes.txt
@@ -12,6 +12,10 @@ FooProject == 1.2 \
   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 \
   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7
 
-colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz
-    --hash=md5:9854316552d41419b678d39af443a75f
+# from direct source
+colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz \
+    --hash=md5:9854316552d41419b678d39af443a75f \
     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a
+
+# unknown hash type -> ignore hash
+something == 1.33.7 --hash=foo:something-invalid
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
index 3dd63b9d..f415b179 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
@@ -18,10 +18,17 @@
     <component type="library">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <modified>false</modified>
     </component>
+    <component type="library">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <modified>false</modified>
+    </component>
     <component type="library">
       <name>urllib3</name>
       <version>1.26.5</version>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
index 3dd63b9d..f415b179 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
@@ -18,10 +18,17 @@
     <component type="library">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <modified>false</modified>
     </component>
+    <component type="library">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <modified>false</modified>
+    </component>
     <component type="library">
       <name>urllib3</name>
       <version>1.26.5</version>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
index f5a35dc4..181133d8 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
@@ -25,10 +25,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
@@ -37,6 +37,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
index f5a35dc4..181133d8 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
@@ -25,10 +25,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
@@ -37,6 +37,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
index c711fdf5..83891256 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
@@ -31,8 +31,8 @@
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "requirements-L15",
-      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
       "externalReferences": [
         {
           "comment": "explicit dist url",
@@ -45,6 +45,21 @@
       "type": "library",
       "version": ""
     },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
@@ -66,7 +81,10 @@
       "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L15"
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
     },
     {
       "ref": "requirements-L4"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
index c711fdf5..83891256 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
@@ -31,8 +31,8 @@
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "requirements-L15",
-      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
       "externalReferences": [
         {
           "comment": "explicit dist url",
@@ -45,6 +45,21 @@
       "type": "library",
       "version": ""
     },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
@@ -66,7 +81,10 @@
       "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L15"
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
     },
     {
       "ref": "requirements-L4"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
index f5b8a454..4c14db73 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
@@ -39,10 +39,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
@@ -51,6 +51,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
@@ -66,7 +78,8 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
-    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
index f5b8a454..4c14db73 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
@@ -39,10 +39,10 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
@@ -51,6 +51,18 @@
         </reference>
       </externalReferences>
     </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
     <component type="library" bom-ref="requirements-L7">
       <name>urllib3</name>
       <version>1.26.5</version>
@@ -66,7 +78,8 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
-    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
index b9633275..b49864dd 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
@@ -51,11 +51,21 @@
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "requirements-L15",
-      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
       "externalReferences": [
         {
           "comment": "explicit dist url",
+          "hashes": [
+            {
+              "alg": "MD5",
+              "content": "9854316552d41419b678d39af443a75f"
+            },
+            {
+              "alg": "SHA-1",
+              "content": "aa1fc7722b9128a3c945048de03f5b4e55157c6a"
+            }
+          ],
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -65,6 +75,21 @@
       "type": "library",
       "version": ""
     },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
@@ -96,7 +121,10 @@
       "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L15"
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
     },
     {
       "ref": "requirements-L4"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
index b9633275..b49864dd 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
@@ -51,11 +51,21 @@
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "requirements-L15",
-      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
       "externalReferences": [
         {
           "comment": "explicit dist url",
+          "hashes": [
+            {
+              "alg": "MD5",
+              "content": "9854316552d41419b678d39af443a75f"
+            },
+            {
+              "alg": "SHA-1",
+              "content": "aa1fc7722b9128a3c945048de03f5b4e55157c6a"
+            }
+          ],
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -65,6 +75,21 @@
       "type": "library",
       "version": ""
     },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
@@ -96,7 +121,10 @@
       "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L15"
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
     },
     {
       "ref": "requirements-L4"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
index 1e4580e5..fa6fabe1 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
@@ -47,15 +47,31 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
           <comment>explicit dist url</comment>
+          <hashes>
+            <hash alg="MD5">9854316552d41419b678d39af443a75f</hash>
+            <hash alg="SHA-1">aa1fc7722b9128a3c945048de03f5b4e55157c6a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -78,7 +94,8 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
-    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
index 1e4580e5..fa6fabe1 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
@@ -47,15 +47,31 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
       <version/>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
           <comment>explicit dist url</comment>
+          <hashes>
+            <hash alg="MD5">9854316552d41419b678d39af443a75f</hash>
+            <hash alg="SHA-1">aa1fc7722b9128a3c945048de03f5b4e55157c6a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -78,7 +94,8 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
-    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
index b6701fa6..d5d98b8f 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
@@ -51,11 +51,21 @@
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "requirements-L15",
-      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
       "externalReferences": [
         {
           "comment": "explicit dist url",
+          "hashes": [
+            {
+              "alg": "MD5",
+              "content": "9854316552d41419b678d39af443a75f"
+            },
+            {
+              "alg": "SHA-1",
+              "content": "aa1fc7722b9128a3c945048de03f5b4e55157c6a"
+            }
+          ],
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -64,6 +74,21 @@
       "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "type": "library"
     },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
@@ -95,7 +120,10 @@
       "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L15"
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
     },
     {
       "ref": "requirements-L4"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
index b6701fa6..d5d98b8f 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
@@ -51,11 +51,21 @@
       "version": "2021.5.30"
     },
     {
-      "bom-ref": "requirements-L15",
-      "description": "requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
       "externalReferences": [
         {
           "comment": "explicit dist url",
+          "hashes": [
+            {
+              "alg": "MD5",
+              "content": "9854316552d41419b678d39af443a75f"
+            },
+            {
+              "alg": "SHA-1",
+              "content": "aa1fc7722b9128a3c945048de03f5b4e55157c6a"
+            }
+          ],
           "type": "distribution",
           "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
         }
@@ -64,6 +74,21 @@
       "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
       "type": "library"
     },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
     {
       "bom-ref": "requirements-L7",
       "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
@@ -95,7 +120,10 @@
       "ref": "requirements-L11"
     },
     {
-      "ref": "requirements-L15"
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
     },
     {
       "ref": "requirements-L4"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
index 8301d74c..f52bca08 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
@@ -74,14 +74,30 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
           <comment>explicit dist url</comment>
+          <hashes>
+            <hash alg="MD5">9854316552d41419b678d39af443a75f</hash>
+            <hash alg="SHA-1">aa1fc7722b9128a3c945048de03f5b4e55157c6a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -104,7 +120,8 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
-    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
index 8301d74c..f52bca08 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
@@ -74,14 +74,30 @@
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="requirements-L15">
+    <component type="library" bom-ref="requirements-L16">
       <name>colorama</name>
-      <description>requirements line 15: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</description>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
       <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
           <comment>explicit dist url</comment>
+          <hashes>
+            <hash alg="MD5">9854316552d41419b678d39af443a75f</hash>
+            <hash alg="SHA-1">aa1fc7722b9128a3c945048de03f5b4e55157c6a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
         </reference>
       </externalReferences>
     </component>
@@ -104,7 +120,8 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L11"/>
-    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
   </dependencies>

From df66bfd40baff4500a8445b76bc6c3ae2ec78411 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 15:03:39 +0100
Subject: [PATCH 125/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 9031e517..21ec7c2b 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -26,7 +26,7 @@
     from argparse import ArgumentParser
     from logging import Logger
 
-    from cyclonedx.model import ExternalReference, HashType
+    from cyclonedx.model import ExternalReference
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component, ComponentType
 

From b3aa1104ba820e75387540858bb98126331551b4 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 15:06:40 +0100
Subject: [PATCH 126/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index d3e7045b..35679e7f 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -101,11 +101,11 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
             vg.add_argument('--validate',
                             help='Validate the result before outputting (default: %(default)s)',
                             action='store_true',
-                            dest='validate',
+                            dest='should_validate',
                             default=True)
             vg.add_argument('--no-validate',
                             help='Do not validate the result before outputting',
-                            dest='validate',
+                            dest='should_validate',
                             action='store_false')
 
         scbbc: Type['BomBuilder']

From 7c75097298eb821406f9c96925614aba58fcb432 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 17 Nov 2023 15:27:28 +0100
Subject: [PATCH 127/155] poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../infiles/poetry/no-deps/pyproject-proto.toml    | 14 +++++++++++---
 .../snapshots/poetry/no-deps-lock20-1.2.json.bin   |  7 +++++++
 .../snapshots/poetry/no-deps-lock20-1.2.xml.bin    |  5 +++++
 .../snapshots/poetry/no-deps-lock20-1.3.json.bin   |  7 +++++++
 .../snapshots/poetry/no-deps-lock20-1.3.xml.bin    |  5 +++++
 .../snapshots/poetry/no-deps-lock20-1.4.json.bin   |  7 +++++++
 .../snapshots/poetry/no-deps-lock20-1.4.xml.bin    |  5 +++++
 7 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
index 76ccc951..cd1da5f7 100644
--- a/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
@@ -1,18 +1,26 @@
 [tool.poetry]
+## https://python-poetry.org/docs/pyproject/
 name = "no-deps"
+license = "Apache-2.0"
 version = "0.1.0"
 description = "packages with all meta, but no deps"
 authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
 homepage = "https://oss.acme.org/my-project/"
 repository = "https://oss.acme.org/my-project.git"
 documentation = "https://oss.acme.org/my-project/docs/"
-
+keywords = ["packaging", "poetry", "test"]
+classifiers = [
+  "Topic :: Software Development :: Build Tools",
+  "Topic :: Software Development :: Libraries :: Python Modules"
+]
 [tool.poetry.urls]
 "Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
 "Funding" = "https://oss.acme.org/my-project/funding/"
 "Change log" = "https://oss.acme.org/my-project/changelog/"
-
-
 [tool.poetry.dependencies]
 python = "*"
 
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
index d9c0f850..c6453208 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
@@ -41,6 +41,13 @@
           "url": "https://oss.acme.org/my-project/"
         }
       ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
       "name": "no-deps",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
index 21c1e47c..f8a8dff0 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
@@ -18,6 +18,11 @@
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
       <externalReferences>
         <reference type="documentation">
           <url>https://oss.acme.org/my-project/docs/</url>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
index ee6a6f59..cb7ce646 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
@@ -41,6 +41,13 @@
           "url": "https://oss.acme.org/my-project/"
         }
       ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
       "name": "no-deps",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
index b9242e70..eb9fe625 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
@@ -18,6 +18,11 @@
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
       <externalReferences>
         <reference type="documentation">
           <url>https://oss.acme.org/my-project/docs/</url>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
index 01dd465d..8f8d8dcc 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
@@ -41,6 +41,13 @@
           "url": "https://oss.acme.org/my-project/"
         }
       ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
       "name": "no-deps",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
index ecaadb96..29da7069 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
@@ -45,6 +45,11 @@
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
       <externalReferences>
         <reference type="documentation">
           <url>https://oss.acme.org/my-project/docs/</url>

From 9aa626c585e3dfdd798a996f0aa6712127d00a27 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 18 Nov 2023 21:46:24 +0100
Subject: [PATCH 128/155] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 21ec7c2b..3b7960cf 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -184,7 +184,6 @@ def __call__(self, *,  # type:ignore[override]
                     (groups_without_s, 'without'),
                 ] for gn in gns
                 if gn not in po_cfg['group'].keys())
-            self._logger.debug('groups_not_found: %r', groups_not_found)
             if len(groups_not_found) > 0:
                 groups_error = GroupsNotFoundError(f'{gn!r} (via {srcn})' for gn, srcn in groups_not_found)
                 self._logger.error(groups_error)

From d22ce6b960393e374a31f30aef057463264ce50c Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 30 Nov 2023 13:46:09 +0100
Subject: [PATCH 129/155] tests: adjust snapshots

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/__init__.py                             | 22 +++++++++++++++----
 .../poetry/group-deps-lock11-1.2.json.bin     |  2 +-
 .../poetry/group-deps-lock11-1.2.xml.bin      |  2 +-
 .../poetry/group-deps-lock11-1.3.json.bin     |  2 +-
 .../poetry/group-deps-lock11-1.3.xml.bin      |  2 +-
 .../poetry/group-deps-lock20-1.2.json.bin     |  2 +-
 .../poetry/group-deps-lock20-1.2.xml.bin      |  2 +-
 .../poetry/group-deps-lock20-1.3.json.bin     |  2 +-
 .../poetry/group-deps-lock20-1.3.xml.bin      |  2 +-
 .../poetry/local-lock10-1.2.json.bin          |  2 +-
 .../snapshots/poetry/local-lock10-1.2.xml.bin |  2 +-
 .../poetry/local-lock10-1.3.json.bin          |  2 +-
 .../snapshots/poetry/local-lock10-1.3.xml.bin |  2 +-
 .../poetry/local-lock11-1.2.json.bin          |  2 +-
 .../snapshots/poetry/local-lock11-1.2.xml.bin |  2 +-
 .../poetry/local-lock11-1.3.json.bin          |  2 +-
 .../snapshots/poetry/local-lock11-1.3.xml.bin |  2 +-
 .../poetry/local-lock20-1.2.json.bin          |  2 +-
 .../snapshots/poetry/local-lock20-1.2.xml.bin |  2 +-
 .../poetry/local-lock20-1.3.json.bin          |  2 +-
 .../snapshots/poetry/local-lock20-1.3.xml.bin |  2 +-
 .../poetry/main-and-dev-lock10-1.2.json.bin   |  2 +-
 .../poetry/main-and-dev-lock10-1.2.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock10-1.3.json.bin   |  2 +-
 .../poetry/main-and-dev-lock10-1.3.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock11-1.2.json.bin   |  2 +-
 .../poetry/main-and-dev-lock11-1.2.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock11-1.3.json.bin   |  2 +-
 .../poetry/main-and-dev-lock11-1.3.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock20-1.2.json.bin   |  2 +-
 .../poetry/main-and-dev-lock20-1.2.xml.bin    |  2 +-
 .../poetry/main-and-dev-lock20-1.3.json.bin   |  2 +-
 .../poetry/main-and-dev-lock20-1.3.xml.bin    |  2 +-
 .../poetry/no-deps-lock20-1.2.json.bin        |  2 +-
 .../poetry/no-deps-lock20-1.2.xml.bin         |  2 +-
 .../poetry/no-deps-lock20-1.3.json.bin        |  2 +-
 .../poetry/no-deps-lock20-1.3.xml.bin         |  2 +-
 .../poetry/no-dev-lock11-1.2.json.bin         |  2 +-
 .../poetry/no-dev-lock11-1.2.xml.bin          |  2 +-
 .../poetry/no-dev-lock11-1.3.json.bin         |  2 +-
 .../poetry/no-dev-lock11-1.3.xml.bin          |  2 +-
 .../poetry/no-dev-lock20-1.2.json.bin         |  2 +-
 .../poetry/no-dev-lock20-1.2.xml.bin          |  2 +-
 .../poetry/no-dev-lock20-1.3.json.bin         |  2 +-
 .../poetry/no-dev-lock20-1.3.xml.bin          |  2 +-
 .../poetry/only-groups-lock11-1.2.json.bin    |  2 +-
 .../poetry/only-groups-lock11-1.2.xml.bin     |  2 +-
 .../poetry/only-groups-lock11-1.3.json.bin    |  2 +-
 .../poetry/only-groups-lock11-1.3.xml.bin     |  2 +-
 .../poetry/only-groups-lock20-1.2.json.bin    |  2 +-
 .../poetry/only-groups-lock20-1.2.xml.bin     |  2 +-
 .../poetry/only-groups-lock20-1.3.json.bin    |  2 +-
 .../poetry/only-groups-lock20-1.3.xml.bin     |  2 +-
 .../private-packges-lock10-1.2.json.bin       |  2 +-
 .../poetry/private-packges-lock10-1.2.xml.bin |  2 +-
 .../private-packges-lock10-1.3.json.bin       |  2 +-
 .../poetry/private-packges-lock10-1.3.xml.bin |  2 +-
 .../private-packges-lock11-1.2.json.bin       |  2 +-
 .../poetry/private-packges-lock11-1.2.xml.bin |  2 +-
 .../private-packges-lock11-1.3.json.bin       |  2 +-
 .../poetry/private-packges-lock11-1.3.xml.bin |  2 +-
 .../private-packges-lock20-1.2.json.bin       |  2 +-
 .../poetry/private-packges-lock20-1.2.xml.bin |  2 +-
 .../private-packges-lock20-1.3.json.bin       |  2 +-
 .../poetry/private-packges-lock20-1.3.xml.bin |  2 +-
 .../regression-issue611-lock20-1.2.json.bin   |  2 +-
 .../regression-issue611-lock20-1.2.xml.bin    |  2 +-
 .../regression-issue611-lock20-1.3.json.bin   |  2 +-
 .../regression-issue611-lock20-1.3.xml.bin    |  2 +-
 .../poetry/some-extras-lock10-1.2.json.bin    |  2 +-
 .../poetry/some-extras-lock10-1.2.xml.bin     |  2 +-
 .../poetry/some-extras-lock10-1.3.json.bin    |  2 +-
 .../poetry/some-extras-lock10-1.3.xml.bin     |  2 +-
 .../poetry/some-extras-lock11-1.2.json.bin    |  2 +-
 .../poetry/some-extras-lock11-1.2.xml.bin     |  2 +-
 .../poetry/some-extras-lock11-1.3.json.bin    |  2 +-
 .../poetry/some-extras-lock11-1.3.xml.bin     |  2 +-
 .../poetry/some-extras-lock20-1.2.json.bin    |  2 +-
 .../poetry/some-extras-lock20-1.2.xml.bin     |  2 +-
 .../poetry/some-extras-lock20-1.3.json.bin    |  2 +-
 .../poetry/some-extras-lock20-1.3.xml.bin     |  2 +-
 .../poetry/some-groups-lock11-1.2.json.bin    |  2 +-
 .../poetry/some-groups-lock11-1.2.xml.bin     |  2 +-
 .../poetry/some-groups-lock11-1.3.json.bin    |  2 +-
 .../poetry/some-groups-lock11-1.3.xml.bin     |  2 +-
 .../poetry/some-groups-lock20-1.2.json.bin    |  2 +-
 .../poetry/some-groups-lock20-1.2.xml.bin     |  2 +-
 .../poetry/some-groups-lock20-1.3.json.bin    |  2 +-
 .../poetry/some-groups-lock20-1.3.xml.bin     |  2 +-
 .../poetry/with-extras-lock10-1.2.json.bin    |  2 +-
 .../poetry/with-extras-lock10-1.2.xml.bin     |  2 +-
 .../poetry/with-extras-lock10-1.3.json.bin    |  2 +-
 .../poetry/with-extras-lock10-1.3.xml.bin     |  2 +-
 .../poetry/with-extras-lock11-1.2.json.bin    |  2 +-
 .../poetry/with-extras-lock11-1.2.xml.bin     |  2 +-
 .../poetry/with-extras-lock11-1.3.json.bin    |  2 +-
 .../poetry/with-extras-lock11-1.3.xml.bin     |  2 +-
 .../poetry/with-extras-lock20-1.2.json.bin    |  2 +-
 .../poetry/with-extras-lock20-1.2.xml.bin     |  2 +-
 .../poetry/with-extras-lock20-1.3.json.bin    |  2 +-
 .../poetry/with-extras-lock20-1.3.xml.bin     |  2 +-
 .../poetry/with-urls-lock10-1.2.json.bin      |  2 +-
 .../poetry/with-urls-lock10-1.2.xml.bin       |  2 +-
 .../poetry/with-urls-lock10-1.3.json.bin      |  2 +-
 .../poetry/with-urls-lock10-1.3.xml.bin       |  2 +-
 .../poetry/with-urls-lock11-1.2.json.bin      |  2 +-
 .../poetry/with-urls-lock11-1.2.xml.bin       |  2 +-
 .../poetry/with-urls-lock11-1.3.json.bin      |  2 +-
 .../poetry/with-urls-lock11-1.3.xml.bin       |  2 +-
 .../poetry/with-urls-lock20-1.2.json.bin      |  2 +-
 .../poetry/with-urls-lock20-1.2.xml.bin       |  2 +-
 .../poetry/with-urls-lock20-1.3.json.bin      |  2 +-
 .../poetry/with-urls-lock20-1.3.xml.bin       |  2 +-
 .../requirements/frozen.txt-1.2.json-file.bin |  2 +-
 .../frozen.txt-1.2.json-stream.bin            |  2 +-
 .../requirements/frozen.txt-1.2.xml-file.bin  |  2 +-
 .../frozen.txt-1.2.xml-stream.bin             |  2 +-
 .../requirements/frozen.txt-1.3.json-file.bin |  2 +-
 .../frozen.txt-1.3.json-stream.bin            |  2 +-
 .../requirements/frozen.txt-1.3.xml-file.bin  |  2 +-
 .../frozen.txt-1.3.xml-stream.bin             |  2 +-
 .../requirements/local.txt-1.2.json-file.bin  |  2 +-
 .../local.txt-1.2.json-stream.bin             |  2 +-
 .../requirements/local.txt-1.2.xml-file.bin   |  2 +-
 .../requirements/local.txt-1.2.xml-stream.bin |  2 +-
 .../requirements/local.txt-1.3.json-file.bin  |  2 +-
 .../local.txt-1.3.json-stream.bin             |  2 +-
 .../requirements/local.txt-1.3.xml-file.bin   |  2 +-
 .../requirements/local.txt-1.3.xml-stream.bin |  2 +-
 .../requirements/nested.txt-1.2.json-file.bin |  2 +-
 .../nested.txt-1.2.json-stream.bin            |  2 +-
 .../requirements/nested.txt-1.2.xml-file.bin  |  2 +-
 .../nested.txt-1.2.xml-stream.bin             |  2 +-
 .../requirements/nested.txt-1.3.json-file.bin |  2 +-
 .../nested.txt-1.3.json-stream.bin            |  2 +-
 .../requirements/nested.txt-1.3.xml-file.bin  |  2 +-
 .../nested.txt-1.3.xml-stream.bin             |  2 +-
 .../private-packages.txt-1.2.json-file.bin    |  2 +-
 .../private-packages.txt-1.2.json-stream.bin  |  2 +-
 .../private-packages.txt-1.2.xml-file.bin     |  2 +-
 .../private-packages.txt-1.2.xml-stream.bin   |  2 +-
 .../private-packages.txt-1.3.json-file.bin    |  2 +-
 .../private-packages.txt-1.3.json-stream.bin  |  2 +-
 .../private-packages.txt-1.3.xml-file.bin     |  2 +-
 .../private-packages.txt-1.3.xml-stream.bin   |  2 +-
 ...ssue448.cp1252.txt.bin-1.2.json-stream.bin |  2 +-
 ...issue448.cp1252.txt.bin-1.2.xml-stream.bin |  2 +-
 ...ssue448.cp1252.txt.bin-1.3.json-stream.bin |  2 +-
 ...issue448.cp1252.txt.bin-1.3.xml-stream.bin |  2 +-
 .../with-comments.txt-1.2.json-file.bin       |  2 +-
 .../with-comments.txt-1.2.json-stream.bin     |  2 +-
 .../with-comments.txt-1.2.xml-file.bin        |  2 +-
 .../with-comments.txt-1.2.xml-stream.bin      |  2 +-
 .../with-comments.txt-1.3.json-file.bin       |  2 +-
 .../with-comments.txt-1.3.json-stream.bin     |  2 +-
 .../with-comments.txt-1.3.xml-file.bin        |  2 +-
 .../with-comments.txt-1.3.xml-stream.bin      |  2 +-
 .../with-extras.txt-1.2.json-file.bin         |  2 +-
 .../with-extras.txt-1.2.json-stream.bin       |  2 +-
 .../with-extras.txt-1.2.xml-file.bin          |  2 +-
 .../with-extras.txt-1.2.xml-stream.bin        |  2 +-
 .../with-extras.txt-1.3.json-file.bin         |  2 +-
 .../with-extras.txt-1.3.json-stream.bin       |  2 +-
 .../with-extras.txt-1.3.xml-file.bin          |  2 +-
 .../with-extras.txt-1.3.xml-stream.bin        |  2 +-
 .../with-hashes.txt-1.2.json-file.bin         |  2 +-
 .../with-hashes.txt-1.2.json-stream.bin       |  2 +-
 .../with-hashes.txt-1.2.xml-file.bin          |  2 +-
 .../with-hashes.txt-1.2.xml-stream.bin        |  2 +-
 .../with-hashes.txt-1.3.json-file.bin         |  2 +-
 .../with-hashes.txt-1.3.json-stream.bin       |  2 +-
 .../with-hashes.txt-1.3.xml-file.bin          |  2 +-
 .../with-hashes.txt-1.3.xml-stream.bin        |  2 +-
 .../with-urls.txt-1.2.json-file.bin           |  2 +-
 .../with-urls.txt-1.2.json-stream.bin         |  2 +-
 .../with-urls.txt-1.2.xml-file.bin            |  2 +-
 .../with-urls.txt-1.2.xml-stream.bin          |  2 +-
 .../with-urls.txt-1.3.json-file.bin           |  2 +-
 .../with-urls.txt-1.3.json-stream.bin         |  2 +-
 .../with-urls.txt-1.3.xml-file.bin            |  2 +-
 .../with-urls.txt-1.3.xml-stream.bin          |  2 +-
 ...hout-pinned-versions.txt-1.2.json-file.bin |  2 +-
 ...ut-pinned-versions.txt-1.2.json-stream.bin |  2 +-
 ...thout-pinned-versions.txt-1.2.xml-file.bin |  2 +-
 ...out-pinned-versions.txt-1.2.xml-stream.bin |  2 +-
 ...hout-pinned-versions.txt-1.3.json-file.bin |  2 +-
 ...ut-pinned-versions.txt-1.3.json-stream.bin |  2 +-
 ...thout-pinned-versions.txt-1.3.xml-file.bin |  2 +-
 ...out-pinned-versions.txt-1.3.xml-stream.bin |  2 +-
 189 files changed, 206 insertions(+), 192 deletions(-)

diff --git a/tests/__init__.py b/tests/__init__.py
index 57cf5b58..6285a721 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -81,11 +81,19 @@ def make_xml_comparable(bom: str) -> str:
     bom = re.sub(  # replace metadata.tools.version
         '        <vendor>CycloneDX</vendor>\n'
         '        <name>cyclonedx-python-lib</name>\n'
-        '        <version>.*?</version>\n'
+        '        <version>.*?</version>',
+        '        <vendor>CycloneDX</vendor>\n'
+        '        <name>cyclonedx-python-lib</name>\n'
+        '        <version>libVersion-testing</version>',
+        bom)
+    bom = re.sub(  # replace metadata.tools.externalReferences
+        '        <vendor>CycloneDX</vendor>\n'
+        '        <name>cyclonedx-python-lib</name>\n'
+        r'        <version>(.*?)</version>\n'
         r'        <externalReferences>[\s\S]*?</externalReferences>',
         '        <vendor>CycloneDX</vendor>\n'
         '        <name>cyclonedx-python-lib</name>\n'
-        '        <version>libVersion-testing</version>\n'
+        r'        <version>\1</version>''\n'
         '        <externalReferences><!-- stripped --></externalReferences>',
         bom)
     return bom
@@ -101,15 +109,21 @@ def make_json_comparable(bom: str) -> str:
         '        "vendor": "CycloneDX",\n'
         '        "version": "thisVersion-testing"')
     bom = re.sub(  # replace metadata.tools.version
-        r'        "externalReferences": \[[\s\S]*?\],\n'
         '        "name": "cyclonedx-python-lib",\n'
         '        "vendor": "CycloneDX",\n'
         '        "version": ".*?"',
-        '        "externalReferences": [   ],\n'
         '        "name": "cyclonedx-python-lib",\n'
         '        "vendor": "CycloneDX",\n'
         '        "version": "libVersion-testing"',
         bom)
+    bom = re.sub(  # replace metadata.tools.externalReferences
+        r'        "externalReferences": \[[\s\S]*?\],\n'
+        '        "name": "cyclonedx-python-lib",\n'
+        '        "vendor": "CycloneDX"',
+        '        "externalReferences": [   ],\n'
+        '        "name": "cyclonedx-python-lib",\n'
+        '        "vendor": "CycloneDX"',
+        bom)
     return bom
 
 
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
index 3ac51276..72561115 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
@@ -200,7 +200,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
index b01bc630..8fdb212f 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
index 265694c3..f8c6b8a0 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
@@ -330,7 +330,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
index c740b5b6..144913d9 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
index 3ac51276..72561115 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
@@ -200,7 +200,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
index b01bc630..8fdb212f 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
index 3a007187..b6dde37b 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
@@ -302,7 +302,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
index f6cb2a9c..b6cca933 100644
--- a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
index d4ef5d46..eeaea176 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
@@ -80,7 +80,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
index d8b41574..21b02f3a 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="local">
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
index c8167960..a7252aea 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
@@ -110,7 +110,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
index bd9b702d..0e033d63 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="local">
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
index c4465b87..9f8f2d25 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
@@ -80,7 +80,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
index 1a127be5..1e0219bf 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="local">
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
index e8ca6a69..64ca561d 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
@@ -110,7 +110,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
index b00153b3..80480295 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="local">
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
index c4465b87..9f8f2d25 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
@@ -80,7 +80,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
index 1a127be5..1e0219bf 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="local">
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
index e8ca6a69..64ca561d 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
@@ -110,7 +110,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
index b00153b3..80480295 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="local">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
index 04ad688b..eeff306d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
@@ -164,7 +164,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
index 9ffe1108..c444cea3 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
index dbdf1ba4..8affa7d9 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
@@ -254,7 +254,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
index aa91453c..588b21a9 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
index 926c010c..2e43e617 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
@@ -200,7 +200,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
index 1ab167fb..279a3f1d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
index 320820ff..6ef9e0a5 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
@@ -326,7 +326,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
index 88907e2e..56ca6a9c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
index 926c010c..2e43e617 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
@@ -200,7 +200,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
index 1ab167fb..279a3f1d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
index a8d31f1a..4a45bee2 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
@@ -302,7 +302,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
index 28a4b061..214c6a82 100644
--- a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
index c6453208..4b36d63d 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
@@ -61,7 +61,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
index f8a8dff0..4e8a60c3 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
index cb7ce646..83f52fb1 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
@@ -61,7 +61,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
index eb9fe625..efc784d2 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin
index 4df4eaa9..20d926a5 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin
@@ -50,7 +50,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin
index 6c42d4dd..0b4cbb8f 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin
index 1b5aa9a2..7a0b172e 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin
@@ -68,7 +68,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin
index 8f0da161..8feff151 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin
index 4df4eaa9..20d926a5 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin
@@ -50,7 +50,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin
index 6c42d4dd..0b4cbb8f 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin
index 1b5aa9a2..7a0b172e 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin
@@ -68,7 +68,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin
index 8f0da161..8feff151 100644
--- a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin
index 987ed988..7ffeaf78 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin
@@ -152,7 +152,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin
index 90eddc07..3edba13c 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin
index 51178e64..09dd6f99 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin
@@ -246,7 +246,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin
index 6265da07..9f1a8ef2 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin
index 987ed988..7ffeaf78 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin
@@ -152,7 +152,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin
index 90eddc07..3edba13c 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin
index 81583c02..76d89c39 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin
@@ -218,7 +218,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin
index 5674b2a1..ac456821 100644
--- a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
index ac35187f..074a680e 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
@@ -74,7 +74,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
index 877ca21a..62f6a5a8 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
index 1d664c74..a605c796 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
@@ -110,7 +110,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
index 4adbdce1..20615fd5 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
index 8adb838d..117389e7 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
@@ -595,7 +595,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
index bce30ce1..bc8621a6 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
index d6851eeb..fc5a992a 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
@@ -1165,7 +1165,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
index ff45af4a..7e304357 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
index 8adb838d..117389e7 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
@@ -595,7 +595,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
index bce30ce1..bc8621a6 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
index 25245cf7..1ab6a8d5 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
@@ -1129,7 +1129,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
index 4088b214..80d327a3 100644
--- a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
index 763b1c13..5b7ae2dc 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
@@ -50,7 +50,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
index 0909fbed..624e73bb 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
index 96787385..cb1ca894 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
@@ -68,7 +68,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
index 354f0332..c36da550 100644
--- a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin
index 1276fffe..04879dc8 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin
@@ -123,7 +123,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin
index 67ba78d2..e20c5504 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
index 8cd95ae9..e269048f 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
@@ -179,7 +179,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
index f42ded4d..8e679260 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
index c3bb368d..6ea5df78 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
@@ -1130,7 +1130,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
index 719f4161..d1cc5a31 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
index 063423e3..cb0319a0 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
@@ -2126,7 +2126,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
index 0bfac609..9821652c 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
index d21db125..91dc7cd4 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
@@ -1688,7 +1688,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
index 747b3d2b..fcdde56b 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
index ffb77f72..0fe2d5c0 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
@@ -3172,7 +3172,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
index 9b11be66..407e093e 100644
--- a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
index 7395b8d7..a7300a42 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
@@ -200,7 +200,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
index d256210e..34de6cf4 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
index ae702b95..b5459389 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
@@ -334,7 +334,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
index 277cd445..31002850 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
index 7395b8d7..a7300a42 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
@@ -200,7 +200,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
index d256210e..34de6cf4 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
index 32880fa8..f52a15e1 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
@@ -302,7 +302,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
index 9680e4e4..2138d5ec 100644
--- a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin
index 8e4fffc1..d16cccf9 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin
@@ -22,7 +22,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin
index 0f9b2e16..274b72a8 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin
index 67f8da1b..eb6a9ec9 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin
@@ -22,7 +22,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin
index 74764c25..f1ee87bd 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin
index 8e4fffc1..d16cccf9 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin
@@ -22,7 +22,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin
index 0f9b2e16..274b72a8 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin
index 67f8da1b..eb6a9ec9 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin
@@ -22,7 +22,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin
index 74764c25..f1ee87bd 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin
index 8e4fffc1..d16cccf9 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin
@@ -22,7 +22,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin
index 0f9b2e16..274b72a8 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin
index 67f8da1b..eb6a9ec9 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin
@@ -22,7 +22,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin
index 74764c25..f1ee87bd 100644
--- a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
index 812beb54..797b0a86 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
@@ -107,7 +107,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
index 51ca297a..b17b4642 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
index 4e647f9e..93276657 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
@@ -139,7 +139,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
index ee9a8cdd..38d12e37 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
index 812beb54..797b0a86 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
@@ -107,7 +107,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
index 51ca297a..b17b4642 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
index 521185cb..03c1cd2e 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
@@ -147,7 +147,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
index e43b0e36..525bc6f0 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
index 812beb54..797b0a86 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
@@ -107,7 +107,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
index 51ca297a..b17b4642 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
index 10c8b386..08e927ee 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
@@ -159,7 +159,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
index fd138e61..3599f763 100644
--- a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
index ca7ee20f..54b59ce1 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
@@ -49,7 +49,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
index ca7ee20f..54b59ce1 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
@@ -49,7 +49,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
index 1051b9e9..0bb8014a 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
index 1051b9e9..0bb8014a 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
index 4d0212bb..721c5238 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
@@ -59,7 +59,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
index 4d0212bb..721c5238 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
@@ -59,7 +59,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
index 396435d8..c5c0f0dd 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
index 396435d8..c5c0f0dd 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
index 28afbbf7..93744060 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
@@ -115,7 +115,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
index 28afbbf7..93744060 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
@@ -115,7 +115,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
index 00cc452e..30ea9c4d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
index 00cc452e..30ea9c4d 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
index d0f16b79..1eb4b4c8 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
@@ -121,7 +121,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
index d0f16b79..1eb4b4c8 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
@@ -121,7 +121,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
index 85af74a9..fb576405 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
index 85af74a9..fb576405 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
index ca7ee20f..54b59ce1 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
@@ -49,7 +49,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
index 95434d63..6dcf4e3f 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
@@ -9,7 +9,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
index 1051b9e9..0bb8014a 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
index 3fd91730..d91fc191 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
index 4d0212bb..721c5238 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
@@ -59,7 +59,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
index 23e46376..ae6bb18c 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
@@ -9,7 +9,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
index 396435d8..c5c0f0dd 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
index f8498cd3..77546d46 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
index b5e84886..9430918e 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
index b5e84886..9430918e 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
index 99f2defa..2cf41d2c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
index 99f2defa..2cf41d2c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
index 11ba5cfe..acfb396c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
index 11ba5cfe..acfb396c 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
index 3cd4c3d7..0fd61ff9 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
index 3cd4c3d7..0fd61ff9 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
index 36834eac..5ab249db 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
index 1ca5c82f..79629f3e 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
index 17a92546..33edf346 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
index b6e887b0..c0227f2c 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
index 1d8a3bfa..a4ebb28b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
index 1d8a3bfa..a4ebb28b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
index abad28a2..b1706738 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
index abad28a2..b1706738 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
index 1768bb4b..6f64580d 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
index 1768bb4b..6f64580d 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
index 0be53e34..e16dafc2 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
index 0be53e34..e16dafc2 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
index e5b29ee8..7c6c6183 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
@@ -31,7 +31,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin
index e5b29ee8..7c6c6183 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin
@@ -31,7 +31,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
index e6ddd4d0..83835cb1 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin
index e6ddd4d0..83835cb1 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
index 11fa05f8..b142eb75 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin
index 11fa05f8..b142eb75 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin
@@ -41,7 +41,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
index 1f24d44a..e18f53f1 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin
index 1f24d44a..e18f53f1 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
index 83891256..785ae11a 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
index 83891256..785ae11a 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
@@ -103,7 +103,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
index 4c14db73..0677ba56 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
index 4c14db73..0677ba56 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
index b49864dd..ae2f9cda 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
@@ -143,7 +143,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
index b49864dd..ae2f9cda 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
@@ -143,7 +143,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
index fa6fabe1..0b03d9a0 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
index fa6fabe1..0b03d9a0 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
index 09d3d19c..6a2396bd 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
index 09d3d19c..6a2396bd 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
index 7535c2ba..9e67b581 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
index 7535c2ba..9e67b581 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
index a9602337..ab5d1242 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
index a9602337..ab5d1242 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
@@ -138,7 +138,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
index f628d99b..ee1b960c 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
index f628d99b..ee1b960c 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
index e37b55dc..51e19752 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
index e37b55dc..51e19752 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
index 233726b4..2e4ce077 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
index 233726b4..2e4ce077 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
index 9b874dd0..1e3fe2ac 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
index 9b874dd0..1e3fe2ac 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
index e585d23d..c944348c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
index e585d23d..c944348c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>

From 800cf6295db2cccfe6c266ef2d231eb09a3db41b Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 1 Dec 2023 11:24:54 +0100
Subject: [PATCH 130/155] comments

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/utils/io.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cyclonedx_py/_internal/utils/io.py b/cyclonedx_py/_internal/utils/io.py
index 0b77525d..c80d5f0c 100644
--- a/cyclonedx_py/_internal/utils/io.py
+++ b/cyclonedx_py/_internal/utils/io.py
@@ -24,6 +24,7 @@
 
 def io2str(io: BinaryIO, *, errors: str = 'strict') -> str:
     data = io.read()
+    # see https://docs.python.org/3/library/codecs.html#standard-encodings
     encoding = (chardetect(data)['encoding'] or getdefaultencoding()).replace(
         # replace Windows-encoding with code-page
         'Windows-', 'cp')

From 26696aa31554dfdb535f855833e70ba47c7a056f Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 1 Dec 2023 12:46:12 +0100
Subject: [PATCH 131/155] test data for requirements meta

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../_data/infiles/requirements/pyproject.toml | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 tests/_data/infiles/requirements/pyproject.toml

diff --git a/tests/_data/infiles/requirements/pyproject.toml b/tests/_data/infiles/requirements/pyproject.toml
new file mode 100644
index 00000000..5e8a4eb4
--- /dev/null
+++ b/tests/_data/infiles/requirements/pyproject.toml
@@ -0,0 +1,36 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "testing-requirements"
+version = "0.1.0"
+description = "a packag with all meta"
+license = "Apache-2.0"
+readme = "README.md"
+requires-python = ">=3.7"
+
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
+
+#  dynamic = [] # TODO
+
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+
+keywords = ["packaging", "pipenv", "test"]
+# classifiers = [] # TODO
+
+# dependencies = [] # TODO
+# optional-dependencies = [] # TODO
+
+# entry-point = {} # TODO
+
+# gui-scripts = {} # TODO
+# scripts = {} # TODO
+

From 3f79f2aba890311ec74bed92dac5225e913b73b4 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 5 Dec 2023 12:55:26 +0100
Subject: [PATCH 132/155] test fix test file derection

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/integration/test_requirements.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 2b8eb56a..00763046 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -31,7 +31,7 @@
 from cyclonedx_py._internal.cli import run as run_cli
 from tests import INFILES_DIRECTORY, SnapshotMixin, make_comparable
 
-infiles = glob(join(INFILES_DIRECTORY, 'requirements', '*'))
+infiles = glob(join(INFILES_DIRECTORY, 'requirements', '*.txt*'))
 
 unsupported_of_sf = [
     (OutputFormat.JSON, SchemaVersion.V1_1),

From 5748d6ac472cb3641b52622d76d69af53bd7d700 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 5 Dec 2023 13:07:08 +0100
Subject: [PATCH 133/155] tests: fix

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/unit/test_cli.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py
index 7d73ffec..373567d4 100644
--- a/tests/unit/test_cli.py
+++ b/tests/unit/test_cli.py
@@ -19,7 +19,7 @@
 import logging
 from io import StringIO
 from os.path import join
-from random import randbytes
+from random import random
 from typing import Any
 from unittest import TestCase
 from unittest.mock import Mock
@@ -139,7 +139,7 @@ def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa:
 
     @classmethod
     def __make_fresh_logger(cls, logstream: StringIO, level: int = logging.NOTSET) -> logging.Logger:
-        logger = logging.getLogger(f'{cls.__qualname__}.{randbytes(15).hex()}')
+        logger = logging.getLogger(f'{cls.__qualname__}.{random()}')  # nosec:B311
         map(logger.removeHandler, logger.handlers)
         logger.level = level
         logger.propagate = False

From dec4804e085c8435c51a6c2f9998643e017d5d81 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 5 Dec 2023 13:34:09 +0100
Subject: [PATCH 134/155] test: update snapshots

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .../regression-issue448.cp1252.txt.bin-1.2.json-file.bin       | 2 +-
 .../regression-issue448.cp1252.txt.bin-1.2.xml-file.bin        | 2 +-
 .../regression-issue448.cp1252.txt.bin-1.3.json-file.bin       | 2 +-
 .../regression-issue448.cp1252.txt.bin-1.3.xml-file.bin        | 2 +-
 tox.ini                                                        | 3 +++
 5 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
index 36834eac..5ab249db 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
index 1ca5c82f..79629f3e 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
index 17a92546..33edf346 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
@@ -67,7 +67,7 @@
       {
         "name": "cyclonedx-python-lib",
         "vendor": "CycloneDX",
-        "version": "5.1.1"
+        "version": "libVersion-testing"
       }
     ]
   },
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
index b6e887b0..c0227f2c 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
@@ -10,7 +10,7 @@
       <tool>
         <vendor>CycloneDX</vendor>
         <name>cyclonedx-python-lib</name>
-        <version>5.1.1</version>
+        <version>libVersion-testing</version>
       </tool>
     </tools>
   </metadata>
diff --git a/tox.ini b/tox.ini
index c3ff1b47..2319fc5b 100644
--- a/tox.ini
+++ b/tox.ini
@@ -25,6 +25,9 @@ commands_pre =
     poetry run pip freeze
 commands =
     poetry run coverage run --source=cyclonedx_py -m unittest discover -t . -s tests -v
+setenv =
+    PYTHONHASHSEED=0
+    CDX_TEST_RECREATE_SNAPSHOTS={env:CDX_TEST_RECREATE_SNAPSHOTS:}
 
 [testenv:mypy{,-current,-lowest}]
 skip_install = True

From dc525a95001a90557c8b5a45f6d1145c22454453 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Tue, 5 Dec 2023 14:56:28 +0100
Subject: [PATCH 135/155] feat: minimal pep621 implementation (#619)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/environment.py         |  4 +-
 cyclonedx_py/_internal/pipenv.py              |  4 +-
 cyclonedx_py/_internal/poetry.py              |  8 +--
 cyclonedx_py/_internal/requirements.py        | 64 ++++++++++++++++---
 cyclonedx_py/_internal/utils/bom.py           | 11 ++--
 cyclonedx_py/_internal/utils/pep621.py        | 39 +++++++++++
 .../_data/infiles/requirements/pyproject.toml |  4 +-
 .../requirements/frozen.txt-1.2.json-file.bin | 10 +++
 .../requirements/frozen.txt-1.2.xml-file.bin  |  6 ++
 .../requirements/frozen.txt-1.3.json-file.bin | 10 +++
 .../requirements/frozen.txt-1.3.xml-file.bin  |  6 ++
 .../requirements/frozen.txt-1.4.json-file.bin | 10 +++
 .../requirements/frozen.txt-1.4.xml-file.bin  |  6 ++
 .../requirements/local.txt-1.2.json-file.bin  | 10 +++
 .../requirements/local.txt-1.2.xml-file.bin   |  6 ++
 .../requirements/local.txt-1.3.json-file.bin  | 10 +++
 .../requirements/local.txt-1.3.xml-file.bin   |  6 ++
 .../requirements/local.txt-1.4.json-file.bin  | 10 +++
 .../requirements/local.txt-1.4.xml-file.bin   |  6 ++
 .../requirements/nested.txt-1.2.json-file.bin | 10 +++
 .../requirements/nested.txt-1.2.xml-file.bin  |  6 ++
 .../requirements/nested.txt-1.3.json-file.bin | 10 +++
 .../requirements/nested.txt-1.3.xml-file.bin  |  6 ++
 .../requirements/nested.txt-1.4.json-file.bin | 10 +++
 .../requirements/nested.txt-1.4.xml-file.bin  |  6 ++
 .../private-packages.txt-1.2.json-file.bin    | 10 +++
 .../private-packages.txt-1.2.xml-file.bin     |  6 ++
 .../private-packages.txt-1.3.json-file.bin    | 10 +++
 .../private-packages.txt-1.3.xml-file.bin     |  6 ++
 .../private-packages.txt-1.4.json-file.bin    | 10 +++
 .../private-packages.txt-1.4.xml-file.bin     |  6 ++
 ...-issue448.cp1252.txt.bin-1.2.json-file.bin | 10 +++
 ...n-issue448.cp1252.txt.bin-1.2.xml-file.bin |  6 ++
 ...-issue448.cp1252.txt.bin-1.3.json-file.bin | 10 +++
 ...n-issue448.cp1252.txt.bin-1.3.xml-file.bin |  6 ++
 ...-issue448.cp1252.txt.bin-1.4.json-file.bin | 10 +++
 ...n-issue448.cp1252.txt.bin-1.4.xml-file.bin |  6 ++
 .../with-comments.txt-1.2.json-file.bin       | 10 +++
 .../with-comments.txt-1.2.xml-file.bin        |  6 ++
 .../with-comments.txt-1.3.json-file.bin       | 10 +++
 .../with-comments.txt-1.3.xml-file.bin        |  6 ++
 .../with-comments.txt-1.4.json-file.bin       | 10 +++
 .../with-comments.txt-1.4.xml-file.bin        |  6 ++
 .../with-extras.txt-1.2.json-file.bin         | 10 +++
 .../with-extras.txt-1.2.xml-file.bin          |  6 ++
 .../with-extras.txt-1.3.json-file.bin         | 10 +++
 .../with-extras.txt-1.3.xml-file.bin          |  6 ++
 .../with-extras.txt-1.4.json-file.bin         | 10 +++
 .../with-extras.txt-1.4.xml-file.bin          |  6 ++
 .../with-hashes.txt-1.2.json-file.bin         | 10 +++
 .../with-hashes.txt-1.2.xml-file.bin          |  6 ++
 .../with-hashes.txt-1.3.json-file.bin         | 10 +++
 .../with-hashes.txt-1.3.xml-file.bin          |  6 ++
 .../with-hashes.txt-1.4.json-file.bin         | 10 +++
 .../with-hashes.txt-1.4.xml-file.bin          |  6 ++
 .../with-urls.txt-1.2.json-file.bin           | 10 +++
 .../with-urls.txt-1.2.xml-file.bin            |  6 ++
 .../with-urls.txt-1.3.json-file.bin           | 10 +++
 .../with-urls.txt-1.3.xml-file.bin            |  6 ++
 .../with-urls.txt-1.4.json-file.bin           | 10 +++
 .../with-urls.txt-1.4.xml-file.bin            |  6 ++
 ...hout-pinned-versions.txt-1.2.json-file.bin | 10 +++
 ...thout-pinned-versions.txt-1.2.xml-file.bin |  6 ++
 ...hout-pinned-versions.txt-1.3.json-file.bin | 10 +++
 ...thout-pinned-versions.txt-1.3.xml-file.bin |  6 ++
 ...hout-pinned-versions.txt-1.4.json-file.bin | 10 +++
 ...thout-pinned-versions.txt-1.4.xml-file.bin |  6 ++
 tests/integration/test_poetry.py              |  2 +-
 tests/integration/test_requirements.py        | 26 +++++++-
 69 files changed, 615 insertions(+), 27 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/pep621.py

diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 7027131a..398d22a5 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -44,12 +44,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
     def __init__(self, *,
                  logger: 'Logger',
-                 **kwargs: Any) -> None:
+                 **__: Any) -> None:
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
                  lock: BinaryIO,
-                 **kwargs: Any) -> 'Bom':
+                 **__: Any) -> 'Bom':
         from .utils.bom import make_bom
 
         bom = make_bom()
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index f81cb9c8..49876309 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -49,12 +49,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
     def __init__(self, *,
                  logger: 'Logger',
-                 **kwargs: Any) -> None:
+                 **__: Any) -> None:
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
                  lock: BinaryIO,
-                 **kwargs: Any) -> 'Bom':
+                 **__: Any) -> 'Bom':
         from .utils.bom import make_bom
 
         bom = make_bom()
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 3b7960cf..6390c99c 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -137,7 +137,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
     def __init__(self, *,
                  logger: 'Logger',
-                 **kwargs: Any) -> None:
+                 **__: Any) -> None:
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
@@ -146,7 +146,7 @@ def __call__(self, *,  # type:ignore[override]
                  no_dev: bool,
                  extras: List[str], all_extras: bool,
                  mc_type: 'ComponentType',
-                 **kwargs: Any) -> 'Bom':
+                 **__: Any) -> 'Bom':
         from os.path import join
 
         from .utils.toml import toml_loads
@@ -156,12 +156,12 @@ def __call__(self, *,  # type:ignore[override]
         try:
             pyproject = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
         except OSError as err:
-            raise ValueError(f"can't open {pyproject_file!r}: {err}")
+            raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
         try:
             lock = open(lock_file, 'rt', encoding='utf8', errors='replace')
         except OSError as err:
             pyproject.close()
-            raise ValueError(f"can't open {lock_file!r}: {err}")
+            raise ValueError(f'Could not open lock file: {lock_file}') from err
 
         with pyproject, lock:
             project = toml_loads(pyproject.read())
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 48b0930d..1c3a18a8 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, Generator, List, Set
+from typing import TYPE_CHECKING, Any, Generator, List, Optional, Set
 
 from . import BomBuilder
 
@@ -26,7 +26,7 @@
 
     from cyclonedx.model import HashType
     from cyclonedx.model.bom import Bom
-    from cyclonedx.model.component import Component
+    from cyclonedx.model.component import Component, ComponentType
     from pip_requirements_parser import InstallRequirement, RequirementsFile  # type:ignore[import-untyped]
 
 
@@ -41,6 +41,10 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
+        from cyclonedx.model.component import ComponentType
+
+        from .utils.args import argparse_type4enum
+
         p = ArgumentParser(description=dedent(""""\
                            Build an SBOM from Pip requirements.
 
@@ -75,6 +79,23 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        action='append',
                        dest='extra_index_urls',
                        default=[])
+        p.add_argument('--pyproject',
+                       metavar='pyproject.toml',
+                       help="Path to the root component's `pyproject.toml` according to PEP621",
+                       dest='pyproject_file',
+                       default=None)
+        _mc_types = [ComponentType.APPLICATION,
+                     ComponentType.FIRMWARE,
+                     ComponentType.LIBRARY]
+        p.add_argument('--mc-type',
+                       metavar='TYPE',
+                       help='Type of the main component'
+                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
+                            ' (default: %(default)s)',
+                       dest='mc_type',
+                       choices=_mc_types,
+                       type=argparse_type4enum(ComponentType),
+                       default=ComponentType.APPLICATION.value)
         p.add_argument('requirements_file',
                        metavar='requirements-file',
                        help='I HELP TODO (default: %(default)r in current working directory)',
@@ -86,18 +107,38 @@ def __init__(self, *,
                  logger: 'Logger',
                  index_url: str,
                  extra_index_urls: List[str],
-                 **kwargs: Any) -> None:
+                 **__: Any) -> None:
         self._logger = logger
         self._index_url = index_url
         self._extra_index_urls = set(extra_index_urls)
 
     def __call__(self, *,  # type:ignore[override]
                  requirements_file: str,
-                 **kwargs: Any) -> 'Bom':
+                 pyproject_file: Optional[str],
+                 mc_type: 'ComponentType',
+                 **__: Any) -> 'Bom':
         from os import unlink
 
         from pip_requirements_parser import RequirementsFile
 
+        if pyproject_file is None:
+            rc = None
+        else:
+            from .utils.pep621 import pyproject2component
+            from .utils.toml import toml_loads
+
+            try:
+                pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
+            except OSError as err:
+                raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
+            with pyproject_fh:
+                rc = pyproject2component(
+                    toml_loads(pyproject_fh.read()),
+                    type=mc_type
+                )
+                rc.bom_ref.value = 'root-component'
+            del pyproject_fh
+
         if requirements_file == '-':
             from sys import stdin
 
@@ -108,17 +149,22 @@ def __call__(self, *,  # type:ignore[override]
                 rf = RequirementsFile.from_file(rt, include_nested=False)
             finally:
                 unlink(rt)
+            del rt
         else:
             rf = RequirementsFile.from_file(requirements_file, include_nested=True)
 
-        return self._make_bom(rf)
-
-    def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
-        from functools import reduce
+        return self._make_bom(rc, rf)
 
+    def _make_bom(self, rc: Optional['Component'], rf: 'RequirementsFile') -> 'Bom':
         from .utils.bom import make_bom
 
         bom = make_bom()
+        self._add_components(bom, rf)
+        bom.metadata.component = rc
+        return bom
+
+    def _add_components(self, bom: 'Bom', rf: 'RequirementsFile') -> None:
+        from functools import reduce
 
         index_url = reduce(lambda c, i: i.options.get('index_url') or c, rf.options, self._index_url)
         extra_index_urls = self._extra_index_urls.union(*(
@@ -133,8 +179,6 @@ def _make_bom(self, rf: 'RequirementsFile') -> 'Bom':
                 self._logger.warning('Component has no pinned version: %r', component)
             bom.components.add(component)
 
-        return bom
-
     def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None, None]:
         from cyclonedx.exception.model import UnknownHashTypeException
         from cyclonedx.model import HashType
diff --git a/cyclonedx_py/_internal/utils/bom.py b/cyclonedx_py/_internal/utils/bom.py
index 623f6d72..a6e24374 100644
--- a/cyclonedx_py/_internal/utils/bom.py
+++ b/cyclonedx_py/_internal/utils/bom.py
@@ -16,15 +16,17 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+from typing import Any
+
 from cyclonedx.model import ExternalReference, ExternalReferenceType, Tool, XsUri
 from cyclonedx.model.bom import Bom
 
 from cyclonedx_py import __version__
 
 
-def make_bom() -> Bom:
-    bom = Bom()
-    tool = Tool(
+def make_bom(**kwargs: Any) -> Bom:
+    bom = Bom(**kwargs)
+    bom.metadata.tools.add(Tool(
         vendor='CycloneDX',
         name='cyclonedx-bom',
         version=__version__ or 'UNKNOWN',
@@ -61,6 +63,5 @@ def make_bom() -> Bom:
                 type=ExternalReferenceType.WEBSITE,
                 url=XsUri('https://github.com/CycloneDX/cyclonedx-python/#readme')
             )
-        ])
-    bom.metadata.tools.add(tool)
+        ]))
     return bom
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
new file mode 100644
index 00000000..7d828f03
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -0,0 +1,39 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+"""functionality related tot PEP 621
+See https://peps.python.org/pep-0621/
+See https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+"""
+
+from typing import Any, Dict
+
+from cyclonedx.model.component import Component, ComponentType
+
+
+def pyproject2component(pyproject: Dict[str, Any], *,
+                        type: ComponentType) -> Component:
+    project = pyproject['project']
+    return Component(
+        type=type,
+        bom_ref=project['name'],
+        name=project['name'],
+        version=project.get('version', None),
+        description=project.get('description', None),
+        # TODO add more properties according to spec
+    )
diff --git a/tests/_data/infiles/requirements/pyproject.toml b/tests/_data/infiles/requirements/pyproject.toml
index 5e8a4eb4..7a5a66e2 100644
--- a/tests/_data/infiles/requirements/pyproject.toml
+++ b/tests/_data/infiles/requirements/pyproject.toml
@@ -1,8 +1,8 @@
 [project]
 # https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
-name = "testing-requirements"
+name = "testing-requirements-txt"
 version = "0.1.0"
-description = "a packag with all meta"
+description = "some `reuqirements.txt` a root-component with all metadata"
 license = "Apache-2.0"
 readme = "README.md"
 requires-python = ">=3.7"
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
index 54b59ce1..dac5f298 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
@@ -37,9 +37,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
index 0bb8014a..d6560072 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -43,5 +48,6 @@
   <dependencies>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
index 721c5238..93e9baca 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
@@ -47,9 +47,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
index c5c0f0dd..718c3961 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -47,5 +52,6 @@
   <dependencies>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
index 017055f9..59f8b71b 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
@@ -47,9 +47,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
index d0e82183..c9416bb4 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -74,5 +79,6 @@
   <dependencies>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
index 93744060..29aefa1e 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
@@ -103,9 +103,19 @@
     },
     {
       "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
index 30ea9c4d..63d4263b 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -89,5 +94,6 @@
     <dependency ref="requirements-L2"/>
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
index 1eb4b4c8..246dec51 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
@@ -109,9 +109,19 @@
     },
     {
       "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
index fb576405..68e99bf1 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -92,5 +97,6 @@
     <dependency ref="requirements-L2"/>
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
index 9e461821..cfbf1936 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
@@ -104,9 +104,19 @@
     },
     {
       "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
index 02871a38..a8f2f7fe 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -114,5 +119,6 @@
     <dependency ref="requirements-L2"/>
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
index 54b59ce1..dac5f298 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
@@ -37,9 +37,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
index 0bb8014a..d6560072 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -43,5 +48,6 @@
   <dependencies>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
index 721c5238..93e9baca 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
@@ -47,9 +47,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
index c5c0f0dd..718c3961 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -47,5 +52,6 @@
   <dependencies>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
index 017055f9..59f8b71b 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
@@ -47,9 +47,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
index d0e82183..c9416bb4 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -74,5 +79,6 @@
   <dependencies>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
index 9430918e..a46dd9a4 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
@@ -29,9 +29,19 @@
   "dependencies": [
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
index 2cf41d2c..312d5b7e 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -38,5 +43,6 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
index acfb396c..046c7822 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
@@ -29,9 +29,19 @@
   "dependencies": [
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
index 0fd61ff9..12331dfe 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -38,5 +43,6 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
index 1ca174e5..eced0504 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
@@ -29,9 +29,19 @@
   "dependencies": [
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
index 1c749b7d..116f18ff 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
@@ -65,5 +70,6 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
index 5ab249db..0906755b 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
@@ -55,9 +55,19 @@
     },
     {
       "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
index 79629f3e..33c9c20b 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
@@ -56,5 +61,6 @@
     <dependency ref="requirements-L6"/>
     <dependency ref="requirements-L7"/>
     <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
index 33edf346..81288fbc 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
@@ -55,9 +55,19 @@
     },
     {
       "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
index c0227f2c..0ce54932 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
@@ -56,5 +61,6 @@
     <dependency ref="requirements-L6"/>
     <dependency ref="requirements-L7"/>
     <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
index 07dc044d..6bbd7da9 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
@@ -52,9 +52,19 @@
     },
     {
       "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
index 39b06991..ed5c50ac 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
@@ -80,5 +85,6 @@
     <dependency ref="requirements-L6"/>
     <dependency ref="requirements-L7"/>
     <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
index a4ebb28b..fd6b9f21 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
@@ -91,9 +91,19 @@
     },
     {
       "ref": "requirements-L5"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
index b1706738..b38b667b 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
@@ -82,5 +87,6 @@
     <dependency ref="requirements-L3"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L5"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
index 6f64580d..547346e5 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
@@ -91,9 +91,19 @@
     },
     {
       "ref": "requirements-L5"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
index e16dafc2..878a2b92 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
@@ -82,5 +87,6 @@
     <dependency ref="requirements-L3"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L5"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
index 9e2a8e28..ab88420d 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
@@ -91,9 +91,19 @@
     },
     {
       "ref": "requirements-L5"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
index 743ded61..2c05c0e4 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
@@ -109,5 +114,6 @@
     <dependency ref="requirements-L3"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L5"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
index 7c6c6183..8127d0d4 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
@@ -19,9 +19,19 @@
   "dependencies": [
     {
       "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
index 83835cb1..2c1190d3 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
@@ -30,5 +35,6 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
index b142eb75..b3cc1c47 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
@@ -29,9 +29,19 @@
   "dependencies": [
     {
       "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
index e18f53f1..2e7d5a42 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
@@ -34,5 +39,6 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
index 7114ebcd..40a15a40 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
@@ -29,9 +29,19 @@
   "dependencies": [
     {
       "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
index d547e445..e9cf4c80 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
@@ -61,5 +66,6 @@
   </components>
   <dependencies>
     <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
index 785ae11a..1ef1d29a 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
@@ -91,9 +91,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
index 0677ba56..cdd2b1fb 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -82,5 +87,6 @@
     <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
index ae2f9cda..7a449172 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
@@ -131,9 +131,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
index 0b03d9a0..ba564a7d 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -98,5 +103,6 @@
     <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
index d5d98b8f..a71c99f1 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
@@ -130,9 +130,19 @@
     },
     {
       "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
index f52bca08..bc83ee13 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -124,5 +129,6 @@
     <dependency ref="requirements-L21"/>
     <dependency ref="requirements-L4"/>
     <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
index 6a2396bd..65d94371 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
@@ -126,9 +126,19 @@
     },
     {
       "ref": "requirements-L9"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
index 9e67b581..edc4c890 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -107,5 +112,6 @@
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L7"/>
     <dependency ref="requirements-L9"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
index ab5d1242..0ee82def 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
@@ -126,9 +126,19 @@
     },
     {
       "ref": "requirements-L9"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
index ee1b960c..72b21c59 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -107,5 +112,6 @@
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L7"/>
     <dependency ref="requirements-L9"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
index b60d3a46..eac344c0 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
@@ -120,9 +120,19 @@
     },
     {
       "ref": "requirements-L9"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
index 0563d7c4..9c33a723 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
@@ -128,5 +133,6 @@
     <dependency ref="requirements-L5"/>
     <dependency ref="requirements-L7"/>
     <dependency ref="requirements-L9"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
index 51e19752..f5e018f5 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
@@ -55,9 +55,19 @@
     },
     {
       "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
index 2e4ce077..0d80e3bb 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
@@ -56,5 +61,6 @@
     <dependency ref="requirements-L1"/>
     <dependency ref="requirements-L2"/>
     <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
index 1e3fe2ac..28da3c9a 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
@@ -55,9 +55,19 @@
     },
     {
       "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
index c944348c..4348e831 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
@@ -13,6 +13,11 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
@@ -56,5 +61,6 @@
     <dependency ref="requirements-L1"/>
     <dependency ref="requirements-L2"/>
     <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
index 0be6cbd0..d8f43d7c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
@@ -52,9 +52,19 @@
     },
     {
       "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
     }
   ],
   "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
index c6b3b32e..b7c9ddd7 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
@@ -40,6 +40,11 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+    </component>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
@@ -80,5 +85,6 @@
     <dependency ref="requirements-L1"/>
     <dependency ref="requirements-L2"/>
     <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
   </dependencies>
 </bom>
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 512fa279..abfc6e22 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -69,7 +69,7 @@ def test_cli_fails_with_dir_not_found(self) -> None:
             err = err.getvalue()
             out = out.getvalue()
         self.assertNotEqual(0, res, err)
-        self.assertIn("No such file or directory: 'something-that-must-not-exist.testing", err)
+        self.assertIn('Could not open pyproject file: something-that-must-not-exist.testing', err)
 
     def test_cli_fails_with_groups_not_found(self) -> None:
         projectdir = random.choice(projectdirs)  # nosec B311
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 00763046..63db8191 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -17,6 +17,7 @@
 
 
 import os
+import random
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob
 from io import StringIO, TextIOWrapper
@@ -33,6 +34,8 @@
 
 infiles = glob(join(INFILES_DIRECTORY, 'requirements', '*.txt*'))
 
+pyproject_file = join(INFILES_DIRECTORY, 'requirements', 'pyproject.toml')
+
 unsupported_of_sf = [
     (OutputFormat.JSON, SchemaVersion.V1_1),
     (OutputFormat.JSON, SchemaVersion.V1_0),
@@ -73,7 +76,26 @@ def test_cli_with_file_not_found(self) -> None:
             err = err.getvalue()
             out = out.getvalue()
         self.assertNotEqual(0, res, err)
-        self.assertIn("No such file or directory: 'something-that-must-not-exist.testing'", err)
+        self.assertIn('Could not open requirements file: something-that-must-not-exist.testing', err)
+
+    def test_cli_with_pyproject_not_found(self) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'requirements',
+                    '-vvv',
+                    f'--sv={SchemaVersion.V1_4.to_version()}',
+                    f'--of={OutputFormat.XML.name}',
+                    '--outfile=-',
+                    '--pyproject=something-that-must-not-exist.testing',
+                    random.choice(test_data)  # nosec B311
+                ])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn('Could not open pyproject file: something-that-must-not-exist.testing', err)
 
     @named_data(*filter(test_data_os_filter, test_data))
     def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -87,6 +109,7 @@ def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: Out
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
                     '--outfile=-',
+                    f'--pyproject={pyproject_file}',
                     infile])
             err = err.getvalue()
             out = out.getvalue()
@@ -108,6 +131,7 @@ def test_cli_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: O
                         f'--sv={sv.to_version()}',
                         f'--of={of.name}',
                         '--outfile=-',
+                        # no pyproject for this case
                         '-'])
             err = err.getvalue()
             out = out.getvalue()

From e9f3e180f91e986f9934eccfba48369adb4e6760 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 15 Dec 2023 11:34:54 +0100
Subject: [PATCH 136/155] adjust log level and detail

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py          | 17 +++++++++--------
 cyclonedx_py/_internal/poetry.py       |  1 +
 cyclonedx_py/_internal/requirements.py | 13 ++++++++-----
 3 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 35679e7f..051da3a1 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -177,7 +177,7 @@ def _validate(self, output: str) -> bool:
             self._logger.warning('Validation skipped.')
             return False
 
-        self._logger.info('Validating to schema: %s/%s', self._schema_version.to_version(), self._output_format.name)
+        self._logger.info('Validating result to schema: %s/%s', self._schema_version.to_version(), self._output_format.name)
         from cyclonedx.validation import make_schemabased_validator
 
         validation_error = make_schemabased_validator(
@@ -186,19 +186,20 @@ def _validate(self, output: str) -> bool:
         ).validate_str(output)
         if validation_error:
             self._logger.debug('Validation Errors: %r', validation_error.data)
-            self._logger.error('The output is invalid to schema '
+            self._logger.error('The result is invalid to schema '
                                f'{self._schema_version.to_version()}/{self._output_format.name}')
-            self._logger.error('Please report the issue and provide all input data to: '
-                               'https://github.com/CycloneDX/cyclonedx-python/issues/new?'
-                               'template=ValidationError-report.md&labels=ValidationError&title=%5BValidationError%5D')
+            self._logger.warning('Please report the issue and provide all input data to: '
+                                 'https://github.com/CycloneDX/cyclonedx-python/issues/new?'
+                                 'template=ValidationError-report.md&'
+                                 'labels=ValidationError&title=%5BValidationError%5D')
             raise ValueError('result is schema-invalid')
-        self._logger.info('Valid.')
+        self._logger.debug('result is schema-valid')
         return True
 
     def _write(self, output: str, outfile: TextIO) -> int:
         self._logger.info('Writing to: %s', outfile.name)
         written = outfile.write(output)
-        self._logger.info('Wrote %i bytes to %s', written, outfile.name)
+        self._logger.debug('Wrote %i bytes to %s', written, outfile.name)
         return written
 
     def _make_output(self, bom: 'Bom') -> str:
@@ -242,7 +243,7 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
         return 1
     del arg_parser, argv
 
-    ll = (logging.NOTSET, logging.WARNING, logging.INFO, logging.DEBUG)[min(3, args.pop('verbosity'))]
+    ll = (logging.WARNING, logging.INFO, logging.DEBUG)[min(2, args.pop('verbosity'))]
     lh = logging.StreamHandler(sys.stderr)
     lh.setLevel(ll)
     lh.setFormatter(logging.Formatter('%(levelname)-8s | %(name)s > %(message)s'))
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 6390c99c..3900a7b1 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -277,6 +277,7 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
             if _existed:
                 self._logger.debug('existing component: %r', le.component)
             else:
+                self._logger.info('add component for package %r', name)
                 self._logger.debug('add component: %r', le.component)
                 le.added2bom = True
                 bom.components.add(le.component)
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 1c3a18a8..a8181349 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -155,12 +155,14 @@ def __call__(self, *,  # type:ignore[override]
 
         return self._make_bom(rc, rf)
 
-    def _make_bom(self, rc: Optional['Component'], rf: 'RequirementsFile') -> 'Bom':
+    def _make_bom(self, root_c: Optional['Component'], rf: 'RequirementsFile') -> 'Bom':
         from .utils.bom import make_bom
 
         bom = make_bom()
+        bom.metadata.component = root_c
+        self._logger.debug('root-component: %r', root_c)
         self._add_components(bom, rf)
-        bom.metadata.component = rc
+
         return bom
 
     def _add_components(self, bom: 'Bom', rf: 'RequirementsFile') -> None:
@@ -174,9 +176,10 @@ def _add_components(self, bom: 'Bom', rf: 'RequirementsFile') -> None:
 
         for requirement in rf.requirements:
             component = self._make_component(requirement, index_url, extra_index_urls)
-            self._logger.debug('Add component: %r', component)
-            if not component.version:
-                self._logger.warning('Component has no pinned version: %r', component)
+            self._logger.info('add component for line %r', requirement.line)
+            self._logger.debug('add component: %r', component)
+            if not component.version and not requirement.is_url:
+                self._logger.warning('component has no pinned version: %r', component)
             bom.components.add(component)
 
     def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None, None]:

From 82643f987123f65281679bd5228acf146f42ecce Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 15 Dec 2023 13:50:57 +0100
Subject: [PATCH 137/155] rewrite: pipenv (#618)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py                 |    4 +-
 cyclonedx_py/_internal/pipenv.py              |  257 ++-
 cyclonedx_py/_internal/poetry.py              |   33 +-
 cyclonedx_py/_internal/requirements.py        |   17 +-
 cyclonedx_py/_internal/utils/args.py          |   21 +-
 cyclonedx_py/_internal/utils/pep621.py        |   25 +-
 tests/__init__.py                             |   22 +-
 .../local_pckages/a/.gitignore                |    0
 .../_helpers/local_pckages/a/README.md        |    1 +
 .../a/dist/package-a-23.42.tar.gz             |  Bin 0 -> 1361 bytes
 .../a/dist/package_a-23.42-py3-none-any.whl   |  Bin 0 -> 1562 bytes
 .../local_pckages/a}/module_a.py              |    0
 .../_helpers/local_pckages/a/pyproject.toml   |   14 +
 .../local_pckages/b/.gitignore                |    0
 .../_helpers/local_pckages/b/README.md        |    1 +
 .../b/dist/package-b-23.42.tar.gz             |  Bin 0 -> 1354 bytes
 .../b/dist/package_b-23.42-py3-none-any.whl   |  Bin 0 -> 1563 bytes
 .../local_pckages/b/module_b.py               |    0
 .../_helpers/local_pckages/b/pyproject.toml   |   14 +
 .../local_pckages/c/.gitignore                |    0
 .../_helpers/local_pckages/c/README.md        |    1 +
 .../c/dist/package-c-23.42.tar.gz             |  Bin 0 -> 1356 bytes
 .../c/dist/package_c-23.42-py3-none-any.whl   |  Bin 0 -> 1561 bytes
 .../local_pckages/c/module_c.py               |    2 +-
 .../_helpers/local_pckages/c/pyproject.toml   |   14 +
 .../pypi-proxy.py                             |    4 +-
 .../infiles/pipenv/category-deps/Pipfile      |   18 +
 .../infiles/pipenv/category-deps/Pipfile.lock |   99 +
 .../pipenv/category-deps/pyproject.toml       |    5 +
 .../infiles/pipenv/default-and-dev/Pipfile    |    9 +
 .../pipenv/default-and-dev/Pipfile.lock       |   78 +
 .../pipenv/default-and-dev/pyproject.toml     |    5 +
 .../infiles/pipenv/editable-self/Pipfile      |    6 +
 .../infiles/pipenv/editable-self/Pipfile.lock |   23 +
 .../pipenv/editable-self/pyproject.toml       |    5 +
 tests/_data/infiles/pipenv/local/Pipfile      |    9 +
 tests/_data/infiles/pipenv/local/Pipfile.lock |   34 +
 .../_data/infiles/pipenv/local/pyproject.toml |    5 +
 tests/_data/infiles/pipenv/no-deps/Pipfile    |    6 +
 .../_data/infiles/pipenv/no-deps/Pipfile.lock |   18 +
 .../infiles/pipenv/no-deps/pyproject.toml     |   36 +
 .../infiles/pipenv/private-packages/Pipfile   |   24 +
 .../pipenv/private-packages/Pipfile.lock      |   50 +
 .../pipenv/private-packages/pyproject.toml    |    5 +
 .../_data/infiles/pipenv/with-extras/Pipfile  |    7 +
 .../infiles/pipenv/with-extras/Pipfile.lock   |  400 ++++
 .../infiles/pipenv/with-extras/pyproject.toml |    5 +
 tests/_data/infiles/pipenv/with-urls/Pipfile  |   12 +
 .../infiles/pipenv/with-urls/Pipfile.lock     |  150 ++
 .../infiles/pipenv/with-urls/pyproject.toml   |    5 +
 .../dist/package_a-23.42-py2.py3-none-any.whl |  Bin 1424 -> 0 bytes
 .../a/dist/package_a-23.42.tar.gz             |  Bin 993 -> 0 bytes
 .../a/dist/unpacked/package_a-23.42/PKG-INFO  |   18 -
 .../unpacked/package_a-23.42/pyproject.toml   |   17 -
 .../poetry/local/local_pckages/a/module_a.py  |   19 -
 .../local/local_pckages/a/pyproject.toml      |   17 -
 .../package_b-1.33.7-py2.py3-none-any.whl     |  Bin 1432 -> 0 bytes
 .../b/dist/package_b-1.33.7.tar.gz            |  Bin 1004 -> 0 bytes
 .../local/local_pckages/b/pyproject.toml      |   17 -
 .../package_c-80.0.85-py2.py3-none-any.whl    |  Bin 1442 -> 0 bytes
 .../c/dist/package_c-80.0.85.tar.gz           |  Bin 996 -> 0 bytes
 .../local/local_pckages/c/pyproject.toml      |   17 -
 .../infiles/poetry/local/lock10/poetry.lock   |   43 +-
 .../infiles/poetry/local/lock11/poetry.lock   |   22 +-
 .../infiles/poetry/local/lock20/poetry.lock   |   24 +-
 .../infiles/poetry/local/pyproject-proto.toml |    7 +-
 .../private-packges/pyproject-proto.toml      |    2 +-
 .../pipenv/category-deps_1.0.xml.bin          |   11 +
 .../pipenv/category-deps_1.1.xml.bin          |   16 +
 .../pipenv/category-deps_1.2.json.bin         |   51 +
 .../pipenv/category-deps_1.2.xml.bin          |   39 +
 .../pipenv/category-deps_1.3.json.bin         |   67 +
 .../pipenv/category-deps_1.3.xml.bin          |   46 +
 .../pipenv/category-deps_1.4.json.bin         |   63 +
 .../pipenv/category-deps_1.4.xml.bin          |   73 +
 .../pipenv/default-and-dev_1.0.xml.bin        |   17 +
 .../pipenv/default-and-dev_1.1.xml.bin        |   27 +
 .../pipenv/default-and-dev_1.2.json.bin       |   68 +
 .../pipenv/default-and-dev_1.2.xml.bin        |   51 +
 .../pipenv/default-and-dev_1.3.json.bin       |  100 +
 .../pipenv/default-and-dev_1.3.xml.bin        |   65 +
 .../pipenv/default-and-dev_1.4.json.bin       |   96 +
 .../pipenv/default-and-dev_1.4.xml.bin        |   92 +
 .../pipenv/editable-self_1.0.xml.bin          |    4 +
 .../pipenv/editable-self_1.1.xml.bin          |    4 +
 .../pipenv/editable-self_1.2.json.bin         |   32 +
 .../pipenv/editable-self_1.2.xml.bin          |   25 +
 .../pipenv/editable-self_1.3.json.bin         |   38 +
 .../pipenv/editable-self_1.3.xml.bin          |   28 +
 .../pipenv/editable-self_1.4.json.bin         |   34 +
 .../pipenv/editable-self_1.4.xml.bin          |   55 +
 .../_data/snapshots/pipenv/local_1.0.xml.bin  |   20 +
 .../_data/snapshots/pipenv/local_1.1.xml.bin  |   35 +
 .../_data/snapshots/pipenv/local_1.2.json.bin |   82 +
 .../_data/snapshots/pipenv/local_1.2.xml.bin  |   60 +
 .../_data/snapshots/pipenv/local_1.3.json.bin |  112 ++
 .../_data/snapshots/pipenv/local_1.3.xml.bin  |   75 +
 .../_data/snapshots/pipenv/local_1.4.json.bin |  105 ++
 .../_data/snapshots/pipenv/local_1.4.xml.bin  |   99 +
 .../snapshots/pipenv/no-deps_1.0.xml.bin      |    4 +
 .../snapshots/pipenv/no-deps_1.1.xml.bin      |    4 +
 .../snapshots/pipenv/no-deps_1.2.json.bin     |   32 +
 .../snapshots/pipenv/no-deps_1.2.xml.bin      |   25 +
 .../snapshots/pipenv/no-deps_1.3.json.bin     |   32 +
 .../snapshots/pipenv/no-deps_1.3.xml.bin      |   25 +
 .../snapshots/pipenv/no-deps_1.4.json.bin     |   28 +
 .../snapshots/pipenv/no-deps_1.4.xml.bin      |   52 +
 .../pipenv/private-packages_1.0.xml.bin       |   23 +
 .../pipenv/private-packages_1.1.xml.bin       |   38 +
 .../pipenv/private-packages_1.2.json.bin      |   85 +
 .../pipenv/private-packages_1.2.xml.bin       |   63 +
 .../pipenv/private-packages_1.3.json.bin      |  133 ++
 .../pipenv/private-packages_1.3.xml.bin       |   84 +
 .../pipenv/private-packages_1.4.json.bin      |  129 ++
 .../pipenv/private-packages_1.4.xml.bin       |  111 ++
 .../pypi-mirror_private-packages_1.0.xml.bin  |   23 +
 .../pypi-mirror_private-packages_1.1.xml.bin  |   38 +
 .../pypi-mirror_private-packages_1.2.json.bin |   75 +
 .../pypi-mirror_private-packages_1.2.xml.bin  |   57 +
 .../pypi-mirror_private-packages_1.3.json.bin |  123 ++
 .../pypi-mirror_private-packages_1.3.xml.bin  |   78 +
 .../pypi-mirror_private-packages_1.4.json.bin |  119 ++
 .../pypi-mirror_private-packages_1.4.xml.bin  |  105 ++
 .../some-categories_category-deps_1.0.xml.bin |   53 +
 .../some-categories_category-deps_1.1.xml.bin |   93 +
 ...some-categories_category-deps_1.2.json.bin |  160 ++
 .../some-categories_category-deps_1.2.xml.bin |  117 ++
 ...some-categories_category-deps_1.3.json.bin |  292 +++
 .../some-categories_category-deps_1.3.xml.bin |  174 ++
 ...some-categories_category-deps_1.4.json.bin |  288 +++
 .../some-categories_category-deps_1.4.xml.bin |  201 ++
 .../with-dev_default-and-dev_1.0.xml.bin      |   47 +
 .../with-dev_default-and-dev_1.1.xml.bin      |   82 +
 .../with-dev_default-and-dev_1.2.json.bin     |  143 ++
 .../with-dev_default-and-dev_1.2.xml.bin      |  105 ++
 .../with-dev_default-and-dev_1.3.json.bin     |  255 +++
 .../with-dev_default-and-dev_1.3.xml.bin      |  154 ++
 .../with-dev_default-and-dev_1.4.json.bin     |  251 +++
 .../with-dev_default-and-dev_1.4.xml.bin      |  181 ++
 .../snapshots/pipenv/with-extras_1.0.xml.bin  |  155 ++
 .../snapshots/pipenv/with-extras_1.1.xml.bin  |  280 +++
 .../snapshots/pipenv/with-extras_1.2.json.bin |  459 +++++
 .../snapshots/pipenv/with-extras_1.2.xml.bin  |  327 ++++
 .../snapshots/pipenv/with-extras_1.3.json.bin | 1619 +++++++++++++++++
 .../snapshots/pipenv/with-extras_1.3.xml.bin  |  692 +++++++
 .../snapshots/pipenv/with-extras_1.4.json.bin | 1615 ++++++++++++++++
 .../snapshots/pipenv/with-extras_1.4.xml.bin  |  719 ++++++++
 .../snapshots/pipenv/with-urls_1.0.xml.bin    |   47 +
 .../snapshots/pipenv/with-urls_1.1.xml.bin    |   82 +
 .../snapshots/pipenv/with-urls_1.2.json.bin   |  153 ++
 .../snapshots/pipenv/with-urls_1.2.xml.bin    |  111 ++
 .../snapshots/pipenv/with-urls_1.3.json.bin   |  577 ++++++
 .../snapshots/pipenv/with-urls_1.3.xml.bin    |  232 +++
 .../snapshots/pipenv/with-urls_1.4.json.bin   |  569 ++++++
 .../snapshots/pipenv/with-urls_1.4.xml.bin    |  255 +++
 .../snapshots/poetry/local-lock10-1.0.xml.bin |    8 +-
 .../snapshots/poetry/local-lock10-1.1.xml.bin |   19 +-
 .../poetry/local-lock10-1.2.json.bin          |   30 +-
 .../snapshots/poetry/local-lock10-1.2.xml.bin |   25 +-
 .../poetry/local-lock10-1.3.json.bin          |   40 +-
 .../snapshots/poetry/local-lock10-1.3.xml.bin |   32 +-
 .../poetry/local-lock10-1.4.json.bin          |   40 +-
 .../snapshots/poetry/local-lock10-1.4.xml.bin |   32 +-
 .../snapshots/poetry/local-lock11-1.0.xml.bin |    4 +-
 .../snapshots/poetry/local-lock11-1.1.xml.bin |   14 +-
 .../poetry/local-lock11-1.2.json.bin          |   22 +-
 .../snapshots/poetry/local-lock11-1.2.xml.bin |   22 +-
 .../poetry/local-lock11-1.3.json.bin          |   26 +-
 .../snapshots/poetry/local-lock11-1.3.xml.bin |   26 +-
 .../poetry/local-lock11-1.4.json.bin          |   26 +-
 .../snapshots/poetry/local-lock11-1.4.xml.bin |   26 +-
 .../snapshots/poetry/local-lock20-1.0.xml.bin |    4 +-
 .../snapshots/poetry/local-lock20-1.1.xml.bin |   14 +-
 .../poetry/local-lock20-1.2.json.bin          |   22 +-
 .../snapshots/poetry/local-lock20-1.2.xml.bin |   22 +-
 .../poetry/local-lock20-1.3.json.bin          |   26 +-
 .../snapshots/poetry/local-lock20-1.3.xml.bin |   26 +-
 .../poetry/local-lock20-1.4.json.bin          |   26 +-
 .../snapshots/poetry/local-lock20-1.4.xml.bin |   26 +-
 .../poetry-lock-regression-issue611.txt.bin   |   17 -
 tests/integration/test_pipenv.py              |  173 ++
 tests/integration/test_poetry.py              |   20 +-
 tests/integration/test_requirements.py        |   26 +-
 183 files changed, 15502 insertions(+), 603 deletions(-)
 rename tests/_data/infiles/{poetry/local => _helpers}/local_pckages/a/.gitignore (100%)
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/a/README.md
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/a/dist/package-a-23.42.tar.gz
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl
 rename tests/_data/infiles/{poetry/local/local_pckages/a/dist/unpacked/package_a-23.42 => _helpers/local_pckages/a}/module_a.py (100%)
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/a/pyproject.toml
 rename tests/_data/infiles/{poetry/local => _helpers}/local_pckages/b/.gitignore (100%)
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/b/README.md
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl
 rename tests/_data/infiles/{poetry/local => _helpers}/local_pckages/b/module_b.py (100%)
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/b/pyproject.toml
 rename tests/_data/infiles/{poetry/local => _helpers}/local_pckages/c/.gitignore (100%)
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/c/README.md
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/c/dist/package-c-23.42.tar.gz
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/c/dist/package_c-23.42-py3-none-any.whl
 rename tests/_data/infiles/{poetry/local => _helpers}/local_pckages/c/module_c.py (98%)
 create mode 100644 tests/_data/infiles/_helpers/local_pckages/c/pyproject.toml
 rename tests/_data/infiles/{poetry/private-packges => _helpers}/pypi-proxy.py (95%)
 create mode 100644 tests/_data/infiles/pipenv/category-deps/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/category-deps/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/category-deps/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/default-and-dev/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/default-and-dev/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/default-and-dev/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/editable-self/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/editable-self/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/editable-self/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/local/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/local/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/local/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/no-deps/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/no-deps/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/no-deps/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/private-packages/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/private-packages/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/private-packages/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/with-extras/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/with-extras/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/with-extras/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/with-urls/Pipfile
 create mode 100644 tests/_data/infiles/pipenv/with-urls/Pipfile.lock
 create mode 100644 tests/_data/infiles/pipenv/with-urls/pyproject.toml
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42-py2.py3-none-any.whl
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42.tar.gz
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/module_a.py
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7.tar.gz
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85-py2.py3-none-any.whl
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85.tar.gz
 delete mode 100644 tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.2.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.3.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.4.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.4.xml.bin
 delete mode 100644 tests/fixtures/poetry-lock-regression-issue611.txt.bin
 create mode 100644 tests/integration/test_pipenv.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 051da3a1..9ebe5539 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -177,7 +177,8 @@ def _validate(self, output: str) -> bool:
             self._logger.warning('Validation skipped.')
             return False
 
-        self._logger.info('Validating result to schema: %s/%s', self._schema_version.to_version(), self._output_format.name)
+        self._logger.info('Validating result to schema: %s/%s',
+                          self._schema_version.to_version(), self._output_format.name)
         from cyclonedx.validation import make_schemabased_validator
 
         validation_error = make_schemabased_validator(
@@ -253,7 +254,6 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
     logger.addHandler(lh)
 
     logger.debug('args: %s', args)
-
     try:
         Command(**args, logger=logger)(**args)
     except Exception as error:
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 49876309..533b7bd7 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, BinaryIO
+from typing import TYPE_CHECKING, Any, Dict, Generator, List, Optional, Set, Tuple
 
 from . import BomBuilder
 
@@ -24,7 +24,11 @@
     from argparse import ArgumentParser
     from logging import Logger
 
+    from cyclonedx.model import ExternalReference
     from cyclonedx.model.bom import Bom
+    from cyclonedx.model.component import Component, ComponentType
+
+    NameDict = Dict[str, Any]
 
 
 # !!! be as lazy loading as possible, as greedy as needed
@@ -32,32 +36,267 @@
 
 
 class PipenvBB(BomBuilder):
+    __LOCKFILE_META = '_meta'
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser, FileType
+        from argparse import OPTIONAL, ArgumentParser
+        from os import getenv
+
+        from cyclonedx.model.component import ComponentType
+
+        from .utils.args import argparse_type4enum, arpaese_split
 
         p = ArgumentParser(description='Build an SBOM from Pipenv',
                            **kwargs)
-        p.add_argument('lock',
-                       metavar='lock-file',
-                       help='I HELP TODO (default: %(default)s)',
+        # the args shall mimic the ones from Pipenv
+        # see also: https://pipenv.pypa.io/en/latest/configuration.html
+        p.add_argument('--categories',
+                       metavar='CATEGORIES',
+                       dest='categories',
+                       type=arpaese_split((' ', ',')),
+                       default=[])
+        p.add_argument('-d', '--dev',
+                       help='both develop and default packages [env var: PIPENV_DEV]',
+                       action='store_true',
+                       dest='dev',
+                       default=getenv('PIPENV_DEV', '').lower() in ('1', 'true', 'yes'))
+        p.add_argument('--pypi-mirror',
+                       metavar='URL',
+                       help='Specify a PyPI mirror [env var: PIPENV_PYPI_MIRROR]',
+                       dest='pypi_url',
+                       default=getenv('PIPENV_PYPI_MIRROR'))
+        p.add_argument('--pyproject',
+                       metavar='pyproject.toml',
+                       help="Path to the root component's `pyproject.toml` according to PEP621",
+                       dest='pyproject_file',
+                       default=None)
+        _mc_types = [ComponentType.APPLICATION,
+                     ComponentType.FIRMWARE,
+                     ComponentType.LIBRARY]
+        p.add_argument('--mc-type',
+                       metavar='TYPE',
+                       help='Type of the main component'
+                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
+                            ' (default: %(default)s)',
+                       dest='mc_type',
+                       choices=_mc_types,
+                       type=argparse_type4enum(ComponentType),
+                       default=ComponentType.APPLICATION.value)
+        p.add_argument('project_directory',
+                       metavar='project-directory',
+                       help='The project directory for Pipenv (default: current working directory)\n'
+                            'Unlike Pipenv tool, there is no auto-detection in this very tool. '  # yet
+                            'Please provide the actual directory that contains `Pipfile` and `Pipfile.lock`',
                        nargs=OPTIONAL,
-                       type=FileType('rb'),
-                       default='Pipfile.lock')
+                       default='.')
         return p
 
     def __init__(self, *,
                  logger: 'Logger',
+                 pypi_url: Optional[str],
                  **__: Any) -> None:
         self._logger = logger
+        self._pypi_url = pypi_url or None  # ignore empty strings
 
     def __call__(self, *,  # type:ignore[override]
-                 lock: BinaryIO,
+                 project_directory: str,
+                 categories: List[str],
+                 dev: bool,
+                 pyproject_file: Optional[str],
+                 mc_type: 'ComponentType',
                  **__: Any) -> 'Bom':
+        from json import loads as json_loads
+        from os.path import join
+
+        # the group-args shall mimic the ones from Pipenv, which uses (comma and/or space)-separated lists
+        # values be like: 'foo bar,bazz' -> ['foo', 'bar', 'bazz']
+        lock_groups: Set[str] = set()
+        if len(categories) == 0:
+            lock_groups.add('default')
+            if dev:
+                lock_groups.add('develop')
+        else:
+            lock_groups.update(categories)
+            lock_groups.discard(self.__LOCKFILE_META)
+            if 'packages' in lock_groups:
+                # replace UI-category with Lock-group
+                lock_groups.remove('packages')
+                lock_groups.add('default')
+            if 'dev-packages' in lock_groups:
+                # replace UI-category with Lock-group
+                lock_groups.remove('dev-packages')
+                lock_groups.add('develop')
+
+        lock_file = join(project_directory, 'Pipfile.lock')
+        try:
+            lock = open(lock_file, 'rt', encoding='utf8', errors='replace')
+        except OSError as err:
+            raise ValueError(f'Could not open lock file: {lock_file}') from err
+        with lock:
+            if pyproject_file is None:
+                rc = None
+            else:
+                from .utils.pep621 import pyproject_file2component
+                rc = pyproject_file2component(pyproject_file, type=mc_type)
+                rc.bom_ref.value = 'root-component'
+
+            return self._make_bom(rc,
+                                  json_loads(lock.read()),
+                                  lock_groups)
+
+    def _make_bom(self, root_c: Optional['Component'],
+                  locker: 'NameDict', use_groups: Set[str]) -> 'Bom':
+        from cyclonedx.model import Property
+        from cyclonedx.model.component import Component, ComponentType
+        from packageurl import PackageURL
+
+        from . import PropertyName
         from .utils.bom import make_bom
 
+        self._logger.debug('use_groups: %r', use_groups)
+
         bom = make_bom()
-        # TODO
+        bom.metadata.component = root_c
+        self._logger.debug('root-component: %r', root_c)
+
+        meta: NameDict = locker[self.__LOCKFILE_META]
+        source_urls: Dict[str, str] = {source['name']: source['url'].rstrip('/') for source in meta.get('sources', ())}
+        if self._pypi_url is not None:
+            source_urls['pypi'] = self._pypi_url.rstrip('/')
+
+        all_components: Dict[str, Component] = {}
+        if root_c:
+            # root for self-installs
+            all_components[root_c.name] = root_c
+        for group_name in use_groups:
+            self._logger.debug('processing group %r ...', group_name)
+            for package_name, package_data in locker.get(group_name, {}).items():
+                if package_name in all_components:
+                    component = all_components[package_name]
+                    self._logger.info('existing component for package %r', package_name)
+                else:
+                    component = all_components[package_name] = Component(
+                        bom_ref=f'{package_name}{package_data.get("version", "")}',
+                        type=ComponentType.LIBRARY,
+                        name=package_name,
+                        version=package_data['version'][2:] if 'version' in package_data else None,
+                        external_references=self.__make_extrefs(package_name, package_data, source_urls),
+                    )
+                    component.purl = PackageURL(type='pypi',
+                                                name=component.name,
+                                                version=component.version,
+                                                qualifiers=self.__purl_qualifiers4lock(package_data, source_urls)
+                                                ) if not self.__is_local(package_data) else None
+                    self._logger.info('add component for package %r', package_name)
+                    self._logger.debug('add component: %r', component)
+                    bom.components.add(component)
+                component.properties.add(Property(
+                    name=PropertyName.PipenvCategory.value,
+                    value=group_name
+                ))
+                component.properties.update(Property(
+                    name=PropertyName.PackageExtra.value,
+                    value=package_extra
+                ) for package_extra in package_data.get('extras', ()))
 
         return bom
+
+    def __is_local(self, data: 'NameDict') -> bool:
+        if 'file' in data:
+            location: str = data['file']
+        elif 'path' in data:
+            location = data['path']
+        else:
+            return False
+        # schema length is expected to be at least 2 chars, to prevent confusion with Windows drive letters `C:\`
+        might_have_schema = location.find(':', 2)
+        if might_have_schema <= 0:
+            return True
+        maybe_schema = location[:might_have_schema]
+        # example data
+        # - file:../MyProject
+        # - file:///home/user/projects/MyProject
+        # - git+file:///home/user/projects/MyProject
+        # - http://acme.org/MyProject/files/foo-bar.tar.gz
+        return maybe_schema == 'file' or maybe_schema.endswith('+file')
+
+    __VCS_TYPES = ('git', 'hg', 'svn', 'bzr')
+    """ VCS types supported by pip.
+        see https://pip.pypa.io/en/latest/topics/vcs-support/#vcs-support
+    """
+
+    def __package_vcs(self, data: 'NameDict') -> Optional[Tuple[str, str]]:
+        for vct in self.__VCS_TYPES:
+            if vct in data:
+                url: str = data[vct]
+                hash_pos = url.find('#')
+                # remove install-annotations, which are behind a `#`
+                return vct, url[:hash_pos] if hash_pos >= 0 else url
+        return None
+
+    def __make_extrefs(self, name: str, data: 'NameDict', source_urls: Dict[str, str]
+                       ) -> Generator['ExternalReference', None, None]:
+        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+
+        hashes = (HashType.from_composite_str(package_hash)
+                  for package_hash
+                  in data.get('hashes', ()))
+        vcs_source = self.__package_vcs(data)
+        try:
+            if vcs_source is not None:
+                vcs_source_url = vcs_source[1]
+                yield ExternalReference(
+                    comment=f'from {vcs_source[0]}',
+                    type=ExternalReferenceType.VCS,
+                    url=XsUri(f'{vcs_source_url}#{data.get("ref", "")}'))
+            elif 'file' in data:
+                yield ExternalReference(
+                    comment='from file',
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(data['file']),
+                    hashes=hashes)
+            elif 'path' in data:
+                yield ExternalReference(
+                    comment='from path',
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(data['path']),
+                    hashes=hashes)
+            elif 'index' in data:
+                yield ExternalReference(
+                    comment=f'from explicit index: {data["index"]}',
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(f'{source_urls[data["index"]]}/{name}/'),
+                    hashes=hashes)
+            else:
+                yield ExternalReference(
+                    comment='from implicit index: pypi',
+                    type=ExternalReferenceType.DISTRIBUTION,
+                    url=XsUri(f'{source_urls["pypi"]}/{name}/'),
+                    hashes=hashes)
+        except (InvalidUriException, UnknownHashTypeException, KeyError) as error:  # pragma: nocover
+            self._logger.debug('skipped dist-extRef for: %r', name, exc_info=error)
+
+    def __purl_qualifiers4lock(self, data: 'NameDict', sourcees: Dict[str, str]) -> 'NameDict':
+        # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+        qs = {}
+        vcs_source = self.__package_vcs(data)
+        if vcs_source is not None:
+            # see section 3.7.4 in https://github.com/spdx/spdx-spec/blob/cfa1b9d08903/chapters/3-package-information.md
+            # > For version-controlled files, the VCS location syntax is similar to a URL and has the:
+            # > `<vcs_tool>+<transport>://<host_name>[/<path_to_repository>][@<revision_tag_or_branch>][#<sub_path>]`
+            qs['vcs_url'] = f'{vcs_source[1]}@{data["ref"]}'
+        elif 'file' in data:
+            if '://files.pythonhosted.org/' not in data['file']:
+                # skip PURL bloat, do not add implicit information
+                qs['download_url'] = data['file']
+        elif 'index' in data:
+            source_url = sourcees.get(data['index'], 'https://pypi.org/simple')
+            if '://pypi.org/' not in source_url:
+                # skip PURL bloat, do not add implicit information
+                qs['repository_url'] = source_url
+        return qs
+
+    def __make_dependency_graph(self) -> None:
+        pass  # TODO: gather info from `pipenv graph --json-tree` and work with it
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 3900a7b1..ee8f32cc 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -116,11 +116,6 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                         dest='all_extras',
                         default=False)
         del eg
-        p.add_argument('project_directory',
-                       metavar='project-directory',
-                       help='The project directory for Poetry (default: current working directory)',
-                       nargs=OPTIONAL,
-                       default='.')
         _mc_types = [ComponentType.APPLICATION,
                      ComponentType.FIRMWARE,
                      ComponentType.LIBRARY]
@@ -133,6 +128,11 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        choices=_mc_types,
                        type=argparse_type4enum(ComponentType),
                        default=ComponentType.APPLICATION.value)
+        p.add_argument('project_directory',
+                       metavar='project-directory',
+                       help='The project directory for Poetry (default: current working directory)',
+                       nargs=OPTIONAL,
+                       default='.')
         return p
 
     def __init__(self, *,
@@ -200,6 +200,7 @@ def __call__(self, *,  # type:ignore[override]
                 raise ValueError('some package extras are unknown') from extras_error
             del extras_not_found
 
+            # the group-args shall mimic the ones from poetry
             if no_dev:
                 groups = {'main', }
             elif len(groups_only_s) > 0:
@@ -252,7 +253,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
             name=root_c.name,
             component=root_c,
             dependencies=set(),
-            extra_deps=dict(),
+            extra_deps={},
             added2bom=True,
             added2bom_extras=use_extras
         )
@@ -288,10 +289,10 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
                 name=PropertyName.PackageExtra.value,
                 value=extra
             ) for extra in new_extras)
-            depends_on = []
+            depends_on: List[Optional['Component']] = []
             for dep in set(chain(
-                [] if _existed else le.dependencies,
-                chain.from_iterable(le.extra_deps.get(extra, []) for extra in new_extras)
+                () if _existed else le.dependencies,
+                chain.from_iterable(le.extra_deps.get(extra, ()) for extra in new_extras)
             )):
                 self._logger.debug('component %r depends on %r', le.component, dep)
                 depm = _dep_pattern.match(dep)
@@ -305,7 +306,7 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
             bom.register_dependency(le.component, filter(None, depends_on))
             return le.component
 
-        depends_on = []
+        depends_on: List[Optional['Component']] = []
         for group_name in use_groups:
             self._logger.debug('processing group %r ...', group_name)
             for dep_name, dep_spec in po_cfg['group'][group_name].get('dependencies', {}).items():
@@ -326,7 +327,7 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
                 if dep_spec.get('optional', False) and dep_name not in extra_deps:
                     self._logger.debug('skip optional dependency: %s', dep_name)
                     continue
-                depends_on.append(_add_ld(dep_name, set(dep_spec.get('extras', []))))
+                depends_on.append(_add_ld(dep_name, set(dep_spec.get('extras', ()))))
         bom.register_dependency(root_c, filter(None, depends_on))
 
         return bom
@@ -462,7 +463,7 @@ def __make_component4lock(self, package: 'NameDict') -> 'Component':
 
     def __purl_qualifiers4lock(self, package: 'NameDict') -> 'NameDict':
         # see https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
-        qs = dict()
+        qs = {}
 
         source = package['source']
         source_type = package['source'].get('type')
@@ -527,7 +528,7 @@ def __extrefs4lock_url(self, package: 'NameDict') -> Generator['ExternalReferenc
                 hashes=[HashType.from_composite_str(package['files'][0]['hash'])] if len(package['files']) else None
             )
         except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
-            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+            self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
 
     def __extrefs4lock_file(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
         from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
@@ -541,7 +542,7 @@ def __extrefs4lock_file(self, package: 'NameDict') -> Generator['ExternalReferen
                 hashes=[HashType.from_composite_str(package['files'][0]['hash'])] if len(package['files']) else None
             )
         except (InvalidUriException, UnknownHashTypeException) as error:  # pragma: nocover
-            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+            self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
 
     def __extrefs4lock_directory(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
         from cyclonedx.exception.model import InvalidUriException
@@ -555,7 +556,7 @@ def __extrefs4lock_directory(self, package: 'NameDict') -> Generator['ExternalRe
                 # no hash for a source-directory
             )
         except InvalidUriException as error:  # pragma: nocover
-            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+            self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
 
     def __extrefs4lock_vcs(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
         from cyclonedx.exception.model import InvalidUriException
@@ -571,4 +572,4 @@ def __extrefs4lock_vcs(self, package: 'NameDict') -> Generator['ExternalReferenc
                 # no hashes, has source.resolved_reference instead, which is a property
             )
         except InvalidUriException as error:  # pragma: nocover
-            self._logger.debug('%s skipped dist-extRef for: %r', package['name'], exc_info=error)
+            self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index a8181349..ac3ece1d 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -124,20 +124,9 @@ def __call__(self, *,  # type:ignore[override]
         if pyproject_file is None:
             rc = None
         else:
-            from .utils.pep621 import pyproject2component
-            from .utils.toml import toml_loads
-
-            try:
-                pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
-            except OSError as err:
-                raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
-            with pyproject_fh:
-                rc = pyproject2component(
-                    toml_loads(pyproject_fh.read()),
-                    type=mc_type
-                )
-                rc.bom_ref.value = 'root-component'
-            del pyproject_fh
+            from .utils.pep621 import pyproject_file2component
+            rc = pyproject_file2component(pyproject_file, type=mc_type)
+            rc.bom_ref.value = 'root-component'
 
         if requirements_file == '-':
             from sys import stdin
diff --git a/cyclonedx_py/_internal/utils/args.py b/cyclonedx_py/_internal/utils/args.py
index 6edc9909..820d9b9a 100644
--- a/cyclonedx_py/_internal/utils/args.py
+++ b/cyclonedx_py/_internal/utils/args.py
@@ -18,7 +18,7 @@
 
 from argparse import ArgumentTypeError
 from enum import Enum
-from typing import Callable, Type, TypeVar
+from typing import Callable, Iterable, List, Type, TypeVar, Union
 
 _E = TypeVar('_E', bound=Enum)
 
@@ -35,3 +35,22 @@ def str2case(value: str) -> _E:
 
 def choices4enum(enum: Type[Enum]) -> str:
     return f'{{choices: {", ".join(sorted(c.name for c in enum))}}}'
+
+
+def arpaese_split(sep: Union[str, Iterable[str]]) -> Callable[[str], List[str]]:
+    if isinstance(sep, str):
+        def repl(value: str) -> str:
+            return value
+    else:
+        _seps = set(sep)
+        sep = _seps.pop()
+
+        def repl(value: str) -> str:
+            for s in _seps:
+                value = value.replace(s, sep)
+            return value
+
+    def str_split(value: str) -> List[str]:
+        return list(filter(None, map(str.strip, repl(value).split(sep))))
+
+    return str_split
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index 7d828f03..0187bea4 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -21,19 +21,36 @@
 See https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
 """
 
-from typing import Any, Dict
+from typing import TYPE_CHECKING, Any, Dict
 
-from cyclonedx.model.component import Component, ComponentType
+if TYPE_CHECKING:
+    from cyclonedx.model.component import Component, ComponentType
 
 
 def pyproject2component(pyproject: Dict[str, Any], *,
-                        type: ComponentType) -> Component:
+                        type: 'ComponentType') -> 'Component':
+    from cyclonedx.model.component import Component
+
     project = pyproject['project']
     return Component(
         type=type,
-        bom_ref=project['name'],
         name=project['name'],
         version=project.get('version', None),
         description=project.get('description', None),
         # TODO add more properties according to spec
     )
+
+
+def pyproject_file2component(pyproject_file: str, *,
+                             type: 'ComponentType') -> 'Component':
+    from .toml import toml_loads
+
+    try:
+        pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
+    except OSError as err:
+        raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
+    with pyproject_fh:
+        return pyproject2component(
+            toml_loads(pyproject_fh.read()),
+            type=type
+        )
diff --git a/tests/__init__.py b/tests/__init__.py
index 6285a721..f8ba3923 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -23,18 +23,32 @@
 from typing import Union
 from unittest import TestCase
 
-from cyclonedx.schema import OutputFormat
+from cyclonedx.schema import OutputFormat, SchemaVersion
 
 from cyclonedx_py import __version__ as __this_version
 
+RECREATE_SNAPSHOTS = '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
+if RECREATE_SNAPSHOTS:
+    print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
+
+
 _TESTDATA_DIRECTORY = join(dirname(__file__), '_data')
 
 INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
 SNAPSHOTS_DIRECTORY = join(_TESTDATA_DIRECTORY, 'snapshots')
 
-RECREATE_SNAPSHOTS = '1' == getenv('CDX_TEST_RECREATE_SNAPSHOTS')
-if RECREATE_SNAPSHOTS:
-    print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
+
+UNSUPPORTED_OF_SV = (
+    (OutputFormat.JSON, SchemaVersion.V1_1),
+    (OutputFormat.JSON, SchemaVersion.V1_0),
+)
+
+SUPPORTED_OF_SV = tuple(
+    (of, sv)
+    for of in OutputFormat
+    for sv in SchemaVersion
+    if (of, sv) not in UNSUPPORTED_OF_SV
+)
 
 
 class SnapshotMixin:
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/.gitignore b/tests/_data/infiles/_helpers/local_pckages/a/.gitignore
similarity index 100%
rename from tests/_data/infiles/poetry/local/local_pckages/a/.gitignore
rename to tests/_data/infiles/_helpers/local_pckages/a/.gitignore
diff --git a/tests/_data/infiles/_helpers/local_pckages/a/README.md b/tests/_data/infiles/_helpers/local_pckages/a/README.md
new file mode 100644
index 00000000..19e11b7d
--- /dev/null
+++ b/tests/_data/infiles/_helpers/local_pckages/a/README.md
@@ -0,0 +1 @@
+build via `python -m build`
diff --git a/tests/_data/infiles/_helpers/local_pckages/a/dist/package-a-23.42.tar.gz b/tests/_data/infiles/_helpers/local_pckages/a/dist/package-a-23.42.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..4bc8f0956c160f044021a37c281e2b8f5929f54d
GIT binary patch
diff --git a/tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl b/tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..b546c551d4f9cfa3f811749cf6cf3d60d56b7cb5
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/module_a.py b/tests/_data/infiles/_helpers/local_pckages/a/module_a.py
similarity index 100%
rename from tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/module_a.py
rename to tests/_data/infiles/_helpers/local_pckages/a/module_a.py
diff --git a/tests/_data/infiles/_helpers/local_pckages/a/pyproject.toml b/tests/_data/infiles/_helpers/local_pckages/a/pyproject.toml
new file mode 100644
index 00000000..c9f2cc3b
--- /dev/null
+++ b/tests/_data/infiles/_helpers/local_pckages/a/pyproject.toml
@@ -0,0 +1,14 @@
+[project]
+name = "package-a"
+version = "23.42"
+description = "some package A"
+license = {text =  "Apache-2.0"}
+authors = []
+requires-python = ">=3.8"
+
+[tool.setuptools]
+py-modules = ["module_a"]
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/.gitignore b/tests/_data/infiles/_helpers/local_pckages/b/.gitignore
similarity index 100%
rename from tests/_data/infiles/poetry/local/local_pckages/b/.gitignore
rename to tests/_data/infiles/_helpers/local_pckages/b/.gitignore
diff --git a/tests/_data/infiles/_helpers/local_pckages/b/README.md b/tests/_data/infiles/_helpers/local_pckages/b/README.md
new file mode 100644
index 00000000..19e11b7d
--- /dev/null
+++ b/tests/_data/infiles/_helpers/local_pckages/b/README.md
@@ -0,0 +1 @@
+build via `python -m build`
diff --git a/tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz b/tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..e5e8b0efd5da3541e3835fb55c3c1d3843ae0aba
GIT binary patch
diff --git a/tests/_data/infiles/_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl b/tests/_data/infiles/_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..2ab38d989ef3f2981de35bf5044fc07fcb0b2ddf
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/module_b.py b/tests/_data/infiles/_helpers/local_pckages/b/module_b.py
similarity index 100%
rename from tests/_data/infiles/poetry/local/local_pckages/b/module_b.py
rename to tests/_data/infiles/_helpers/local_pckages/b/module_b.py
diff --git a/tests/_data/infiles/_helpers/local_pckages/b/pyproject.toml b/tests/_data/infiles/_helpers/local_pckages/b/pyproject.toml
new file mode 100644
index 00000000..fdc0c21b
--- /dev/null
+++ b/tests/_data/infiles/_helpers/local_pckages/b/pyproject.toml
@@ -0,0 +1,14 @@
+[project]
+name = "package-b"
+version = "23.42"
+description = "some package B"
+license = {text =  "Apache-2.0"}
+authors = []
+requires-python = ">=3.8"
+
+[tool.setuptools]
+py-modules = ["module_b"]
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/.gitignore b/tests/_data/infiles/_helpers/local_pckages/c/.gitignore
similarity index 100%
rename from tests/_data/infiles/poetry/local/local_pckages/c/.gitignore
rename to tests/_data/infiles/_helpers/local_pckages/c/.gitignore
diff --git a/tests/_data/infiles/_helpers/local_pckages/c/README.md b/tests/_data/infiles/_helpers/local_pckages/c/README.md
new file mode 100644
index 00000000..19e11b7d
--- /dev/null
+++ b/tests/_data/infiles/_helpers/local_pckages/c/README.md
@@ -0,0 +1 @@
+build via `python -m build`
diff --git a/tests/_data/infiles/_helpers/local_pckages/c/dist/package-c-23.42.tar.gz b/tests/_data/infiles/_helpers/local_pckages/c/dist/package-c-23.42.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..ee6890ed0ffd8e46fb8ed199d5361b7a1354bbc6
GIT binary patch
diff --git a/tests/_data/infiles/_helpers/local_pckages/c/dist/package_c-23.42-py3-none-any.whl b/tests/_data/infiles/_helpers/local_pckages/c/dist/package_c-23.42-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..1d9fd7c18c4816e935f63e34287aab0ff7bec2cb
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/module_c.py b/tests/_data/infiles/_helpers/local_pckages/c/module_c.py
similarity index 98%
rename from tests/_data/infiles/poetry/local/local_pckages/c/module_c.py
rename to tests/_data/infiles/_helpers/local_pckages/c/module_c.py
index 8cc519ad..e23e0482 100644
--- a/tests/_data/infiles/poetry/local/local_pckages/c/module_c.py
+++ b/tests/_data/infiles/_helpers/local_pckages/c/module_c.py
@@ -15,5 +15,5 @@
 
 
 """
-module C
+module B
 """
diff --git a/tests/_data/infiles/_helpers/local_pckages/c/pyproject.toml b/tests/_data/infiles/_helpers/local_pckages/c/pyproject.toml
new file mode 100644
index 00000000..ee21be96
--- /dev/null
+++ b/tests/_data/infiles/_helpers/local_pckages/c/pyproject.toml
@@ -0,0 +1,14 @@
+[project]
+name = "package-c"
+version = "23.42"
+description = "some package C"
+license = {text =  "Apache-2.0"}
+authors = []
+requires-python = ">=3.8"
+
+[tool.setuptools]
+py-modules = ["module_c"]
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
diff --git a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py b/tests/_data/infiles/_helpers/pypi-proxy.py
similarity index 95%
rename from tests/_data/infiles/poetry/private-packges/pypi-proxy.py
rename to tests/_data/infiles/_helpers/pypi-proxy.py
index 39481a8f..6d6edee1 100755
--- a/tests/_data/infiles/poetry/private-packges/pypi-proxy.py
+++ b/tests/_data/infiles/_helpers/pypi-proxy.py
@@ -18,8 +18,8 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 """
-This is a small http proxy to PiPI.
-This might be needed to play this setup.
+This is a small http proxy to PyPI.
+This might be needed to play certain setups.
 """
 
 import sys
diff --git a/tests/_data/infiles/pipenv/category-deps/Pipfile b/tests/_data/infiles/pipenv/category-deps/Pipfile
new file mode 100644
index 00000000..0df0f6a2
--- /dev/null
+++ b/tests/_data/infiles/pipenv/category-deps/Pipfile
@@ -0,0 +1,18 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+toml = ">=0.10.2, <0.11"
+
+[dev-packages]
+ddt = ">=1.6.0, <2"
+
+# custom catrogys/groups
+# see https://pipenv.pypa.io/en/latest/pipfile.html#package-category-groups
+
+[categoryB]
+colorama = ">=0.4.3"
+
+[groupA]
+isoduration = "==20.11.0"
+colorama = ">=0.4, <0.5"
diff --git a/tests/_data/infiles/pipenv/category-deps/Pipfile.lock b/tests/_data/infiles/pipenv/category-deps/Pipfile.lock
new file mode 100644
index 00000000..668b5145
--- /dev/null
+++ b/tests/_data/infiles/pipenv/category-deps/Pipfile.lock
@@ -0,0 +1,99 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "89162a3ad75438bdbaf691099103dfacb02ee2d655ab1369b20abd1da4250457"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "categoryB": {
+        "colorama": {
+            "hashes": [
+                "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44",
+                "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6'",
+            "version": "==0.4.6"
+        }
+    },
+    "default": {
+        "toml": {
+            "hashes": [
+                "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
+                "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==0.10.2"
+        }
+    },
+    "develop": {
+        "ddt": {
+            "hashes": [
+                "sha256:a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114",
+                "sha256:d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            ],
+            "index": "pypi",
+            "version": "==1.7.0"
+        }
+    },
+    "groupA": {
+        "arrow": {
+            "hashes": [
+                "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80",
+                "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==1.3.0"
+        },
+        "colorama": {
+            "hashes": [
+                "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44",
+                "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6'",
+            "version": "==0.4.6"
+        },
+        "isoduration": {
+            "hashes": [
+                "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9",
+                "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '3.7'",
+            "version": "==20.11.0"
+        },
+        "python-dateutil": {
+            "hashes": [
+                "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86",
+                "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==2.8.2"
+        },
+        "six": {
+            "hashes": [
+                "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
+                "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.16.0"
+        },
+        "types-python-dateutil": {
+            "hashes": [
+                "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b",
+                "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            ],
+            "version": "==2.8.19.14"
+        }
+    }
+}
diff --git a/tests/_data/infiles/pipenv/category-deps/pyproject.toml b/tests/_data/infiles/pipenv/category-deps/pyproject.toml
new file mode 100644
index 00000000..75b5f16f
--- /dev/null
+++ b/tests/_data/infiles/pipenv/category-deps/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "category-deps"
+version = "0.1.0"
+description = "dependencies organized in groups"
diff --git a/tests/_data/infiles/pipenv/default-and-dev/Pipfile b/tests/_data/infiles/pipenv/default-and-dev/Pipfile
new file mode 100644
index 00000000..60004aaa
--- /dev/null
+++ b/tests/_data/infiles/pipenv/default-and-dev/Pipfile
@@ -0,0 +1,9 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+colorama = "*"
+toml = ">=0.10.2, <0.11"
+
+[dev-packages]
+isoduration = ">=20.11.0, <21"
diff --git a/tests/_data/infiles/pipenv/default-and-dev/Pipfile.lock b/tests/_data/infiles/pipenv/default-and-dev/Pipfile.lock
new file mode 100644
index 00000000..628dca98
--- /dev/null
+++ b/tests/_data/infiles/pipenv/default-and-dev/Pipfile.lock
@@ -0,0 +1,78 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "f37a8525dd6225c9497af74cff4a2c5150976733d9f3616448109c7031093349"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "colorama": {
+            "hashes": [
+                "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44",
+                "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6'",
+            "version": "==0.4.6"
+        },
+        "toml": {
+            "hashes": [
+                "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
+                "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==0.10.2"
+        }
+    },
+    "develop": {
+        "arrow": {
+            "hashes": [
+                "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80",
+                "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==1.3.0"
+        },
+        "isoduration": {
+            "hashes": [
+                "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9",
+                "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '3.7'",
+            "version": "==20.11.0"
+        },
+        "python-dateutil": {
+            "hashes": [
+                "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86",
+                "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==2.8.2"
+        },
+        "six": {
+            "hashes": [
+                "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
+                "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.16.0"
+        },
+        "types-python-dateutil": {
+            "hashes": [
+                "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b",
+                "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            ],
+            "version": "==2.8.19.14"
+        }
+    }
+}
diff --git a/tests/_data/infiles/pipenv/default-and-dev/pyproject.toml b/tests/_data/infiles/pipenv/default-and-dev/pyproject.toml
new file mode 100644
index 00000000..677c602d
--- /dev/null
+++ b/tests/_data/infiles/pipenv/default-and-dev/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "default-and-dev"
+version = "0.1.0"
+description = "default and dev depenndencies"
diff --git a/tests/_data/infiles/pipenv/editable-self/Pipfile b/tests/_data/infiles/pipenv/editable-self/Pipfile
new file mode 100644
index 00000000..57e29d13
--- /dev/null
+++ b/tests/_data/infiles/pipenv/editable-self/Pipfile
@@ -0,0 +1,6 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+# https://pipenv.pypa.io/en/latest/specifiers.html?highlight=ref#editable-dependencies-e
+editable-self = {path = ".", editable = true}
diff --git a/tests/_data/infiles/pipenv/editable-self/Pipfile.lock b/tests/_data/infiles/pipenv/editable-self/Pipfile.lock
new file mode 100644
index 00000000..d5208fc4
--- /dev/null
+++ b/tests/_data/infiles/pipenv/editable-self/Pipfile.lock
@@ -0,0 +1,23 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "eeede3274cf3ff5afa3e8133d5dec39de8939885aad846fb1e5d4807898a57de"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "editable-self": {
+            "editable": true,
+            "path": "."
+        }
+    },
+    "develop": {}
+}
diff --git a/tests/_data/infiles/pipenv/editable-self/pyproject.toml b/tests/_data/infiles/pipenv/editable-self/pyproject.toml
new file mode 100644
index 00000000..3df2eb00
--- /dev/null
+++ b/tests/_data/infiles/pipenv/editable-self/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "editable-self"
+version = "0.1.0"
+description = "install the current project as an editable"
diff --git a/tests/_data/infiles/pipenv/local/Pipfile b/tests/_data/infiles/pipenv/local/Pipfile
new file mode 100644
index 00000000..d3dbddb6
--- /dev/null
+++ b/tests/_data/infiles/pipenv/local/Pipfile
@@ -0,0 +1,9 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+package-a = {file = "../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"}
+package-b = {file = "file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"}
+package-c = {path = "../../_helpers/local_pckages/c"}
+
+[dev-packages]
diff --git a/tests/_data/infiles/pipenv/local/Pipfile.lock b/tests/_data/infiles/pipenv/local/Pipfile.lock
new file mode 100644
index 00000000..d277960a
--- /dev/null
+++ b/tests/_data/infiles/pipenv/local/Pipfile.lock
@@ -0,0 +1,34 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "b6b344a88a20d99f1cff5db6c549e31c5aa79bf36bb9859c3f818ef795d62850"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "package-a": {
+            "file": "../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz",
+            "hashes": [
+                "sha256:3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
+            ]
+        },
+        "package-b": {
+            "file": "file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl",
+            "hashes": [
+                "sha256:4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
+            ]
+        },
+        "package-c": {
+            "path": "../../_helpers/local_pckages/c"
+        }
+    },
+    "develop": {}
+}
diff --git a/tests/_data/infiles/pipenv/local/pyproject.toml b/tests/_data/infiles/pipenv/local/pyproject.toml
new file mode 100644
index 00000000..6291093d
--- /dev/null
+++ b/tests/_data/infiles/pipenv/local/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "local"
+version = "0.1.0"
+description = "packages from local paths"
diff --git a/tests/_data/infiles/pipenv/no-deps/Pipfile b/tests/_data/infiles/pipenv/no-deps/Pipfile
new file mode 100644
index 00000000..ddc8b05b
--- /dev/null
+++ b/tests/_data/infiles/pipenv/no-deps/Pipfile
@@ -0,0 +1,6 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+
+[dev-packages]
diff --git a/tests/_data/infiles/pipenv/no-deps/Pipfile.lock b/tests/_data/infiles/pipenv/no-deps/Pipfile.lock
new file mode 100644
index 00000000..d2c2cba4
--- /dev/null
+++ b/tests/_data/infiles/pipenv/no-deps/Pipfile.lock
@@ -0,0 +1,18 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "ebffa69a1fa192d1cef7cb42ad79231ca976565c5ce371a70160b3048d3cbc06"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {},
+    "develop": {}
+}
diff --git a/tests/_data/infiles/pipenv/no-deps/pyproject.toml b/tests/_data/infiles/pipenv/no-deps/pyproject.toml
new file mode 100644
index 00000000..1692cab8
--- /dev/null
+++ b/tests/_data/infiles/pipenv/no-deps/pyproject.toml
@@ -0,0 +1,36 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "no-deps"
+version = "0.1.0"
+description = "packages with all meta, but no deps"
+license = "Apache-2.0"
+readme = "README.md"
+requires-python = ">=3.8"
+
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
+
+#  dynamic = [] # TODO
+
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+
+keywords = ["packaging", "pipenv", "test"]
+# classifiers = [] # TODO
+
+# dependencies = [] # TODO
+# optional-dependencies = [] # TODO
+
+# entry-point = {} # TODO
+
+# gui-scripts = {} # TODO
+# scripts = {} # TODO
+
diff --git a/tests/_data/infiles/pipenv/private-packages/Pipfile b/tests/_data/infiles/pipenv/private-packages/Pipfile
new file mode 100644
index 00000000..d77ae7a2
--- /dev/null
+++ b/tests/_data/infiles/pipenv/private-packages/Pipfile
@@ -0,0 +1,24 @@
+[pipenv]
+sort_pipfile = true
+install_search_all_sources = true
+
+# see https://pipenv.pypa.io/en/latest/indexes.html#specifying-package-indexes
+# run the `//tests/_data/infiles/_helpers/pypi-proxy.py` to setup a PyPI proxy
+# call with `pipenv ... --pypi-mirror http://pysrc2.acme.org:8080/simple/ ...`
+
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[[source]]
+url = "http://pysrc1.acme.org:8080/simple/"
+verify_ssl = false
+name = "pysrc1.acme.org"
+
+[packages]
+numpy = {version="*", index="pypi"}
+six = "*"
+toml = {version = "*", index="pysrc1.acme.org"}
+
+[dev-packages]
diff --git a/tests/_data/infiles/pipenv/private-packages/Pipfile.lock b/tests/_data/infiles/pipenv/private-packages/Pipfile.lock
new file mode 100644
index 00000000..38595ec4
--- /dev/null
+++ b/tests/_data/infiles/pipenv/private-packages/Pipfile.lock
@@ -0,0 +1,50 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "4fe98ad8f0ec8924817a18f60955c867bef55a6fa0075a21062543f56af56de7"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            },
+            {
+                "name": "pysrc1.acme.org",
+                "url": "http://pysrc1.acme.org:8080/simple/",
+                "verify_ssl": false
+            }
+        ]
+    },
+    "default": {
+        "numpy": {
+            "hashes": [
+                "sha256:96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b",
+                "sha256:f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '3.9'",
+            "version": "==1.26.2"
+        },
+        "six": {
+            "hashes": [
+                "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
+                "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.16.0"
+        },
+        "toml": {
+            "hashes": [
+                "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
+                "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            ],
+            "index": "pysrc1.acme.org",
+            "markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==0.10.2"
+        }
+    },
+    "develop": {}
+}
diff --git a/tests/_data/infiles/pipenv/private-packages/pyproject.toml b/tests/_data/infiles/pipenv/private-packages/pyproject.toml
new file mode 100644
index 00000000..caf07823
--- /dev/null
+++ b/tests/_data/infiles/pipenv/private-packages/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "private-packges"
+version = "0.1.0"
+description = "packages from aternative package repositories"
diff --git a/tests/_data/infiles/pipenv/with-extras/Pipfile b/tests/_data/infiles/pipenv/with-extras/Pipfile
new file mode 100644
index 00000000..b779fbec
--- /dev/null
+++ b/tests/_data/infiles/pipenv/with-extras/Pipfile
@@ -0,0 +1,7 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+cyclonedx-python-lib = {version = "==5.1.1", extras = ["xml-validation", "json-validation"]}
+
+[dev-packages]
diff --git a/tests/_data/infiles/pipenv/with-extras/Pipfile.lock b/tests/_data/infiles/pipenv/with-extras/Pipfile.lock
new file mode 100644
index 00000000..4c2b6f13
--- /dev/null
+++ b/tests/_data/infiles/pipenv/with-extras/Pipfile.lock
@@ -0,0 +1,400 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "7fc80a7a63ba5f91c6df003ab8001fc91ef79d9669d32a2159d52cad351e52cf"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "arrow": {
+            "hashes": [
+                "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80",
+                "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==1.3.0"
+        },
+        "attrs": {
+            "hashes": [
+                "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04",
+                "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            ],
+            "markers": "python_version >= '3.7'",
+            "version": "==23.1.0"
+        },
+        "boolean.py": {
+            "hashes": [
+                "sha256:17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4",
+                "sha256:2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            ],
+            "version": "==4.0"
+        },
+        "cyclonedx-python-lib": {
+            "extras": [
+                "json-validation",
+                "xml-validation"
+            ],
+            "hashes": [
+                "sha256:215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6",
+                "sha256:2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            ],
+            "markers": "python_version >= '3.8' and python_version < '4.0'",
+            "version": "==5.1.1"
+        },
+        "defusedxml": {
+            "hashes": [
+                "sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69",
+                "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'",
+            "version": "==0.7.1"
+        },
+        "fqdn": {
+            "hashes": [
+                "sha256:105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f",
+                "sha256:3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            ],
+            "version": "==1.5.1"
+        },
+        "idna": {
+            "hashes": [
+                "sha256:9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca",
+                "sha256:c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            ],
+            "version": "==3.6"
+        },
+        "isoduration": {
+            "hashes": [
+                "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9",
+                "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            ],
+            "version": "==20.11.0"
+        },
+        "jsonpointer": {
+            "hashes": [
+                "sha256:15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a",
+                "sha256:585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            ],
+            "version": "==2.4"
+        },
+        "jsonschema": {
+            "extras": [
+                "format"
+            ],
+            "hashes": [
+                "sha256:4f614fd46d8d61258610998997743ec5492a648b33cf478c1ddc23ed4598a5fa",
+                "sha256:ed6231f0429ecf966f5bc8dfef245998220549cbbcf140f913b7464c52c3b6b3"
+            ],
+            "version": "==4.20.0"
+        },
+        "jsonschema-specifications": {
+            "hashes": [
+                "sha256:9472fc4fea474cd74bea4a2b190daeccb5a9e4db2ea80efcf7a1b582fc9a81b8",
+                "sha256:e74ba7c0a65e8cb49dc26837d6cfe576557084a8b423ed16a420984228104f93"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==2023.11.2"
+        },
+        "license-expression": {
+            "hashes": [
+                "sha256:1a7dc2bb2d09cdc983d072e4f9adc787e107e09def84cbb3919baaaf4f8e6fa1",
+                "sha256:599928edd995c43fc335e0af342076144dc71cb858afa1ed9c1c30c4e81794f5"
+            ],
+            "markers": "python_version >= '3.7'",
+            "version": "==30.2.0"
+        },
+        "lxml": {
+            "hashes": [
+                "sha256:05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3",
+                "sha256:075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d",
+                "sha256:081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a",
+                "sha256:0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120",
+                "sha256:0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305",
+                "sha256:0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287",
+                "sha256:0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23",
+                "sha256:120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52",
+                "sha256:1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f",
+                "sha256:141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4",
+                "sha256:14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584",
+                "sha256:1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f",
+                "sha256:17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693",
+                "sha256:1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef",
+                "sha256:1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5",
+                "sha256:23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02",
+                "sha256:25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc",
+                "sha256:2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7",
+                "sha256:303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da",
+                "sha256:3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a",
+                "sha256:3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40",
+                "sha256:411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8",
+                "sha256:42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd",
+                "sha256:46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601",
+                "sha256:48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c",
+                "sha256:48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be",
+                "sha256:4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2",
+                "sha256:4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c",
+                "sha256:4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129",
+                "sha256:4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc",
+                "sha256:4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2",
+                "sha256:4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1",
+                "sha256:4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7",
+                "sha256:50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d",
+                "sha256:50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477",
+                "sha256:53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d",
+                "sha256:5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e",
+                "sha256:56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7",
+                "sha256:578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2",
+                "sha256:57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574",
+                "sha256:57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf",
+                "sha256:5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b",
+                "sha256:5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98",
+                "sha256:64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12",
+                "sha256:65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42",
+                "sha256:6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35",
+                "sha256:690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d",
+                "sha256:6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce",
+                "sha256:704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d",
+                "sha256:71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f",
+                "sha256:71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db",
+                "sha256:7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4",
+                "sha256:8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694",
+                "sha256:8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac",
+                "sha256:8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2",
+                "sha256:8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7",
+                "sha256:92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96",
+                "sha256:97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d",
+                "sha256:9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b",
+                "sha256:9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a",
+                "sha256:9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13",
+                "sha256:9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340",
+                "sha256:9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6",
+                "sha256:aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458",
+                "sha256:ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c",
+                "sha256:b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c",
+                "sha256:b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9",
+                "sha256:b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432",
+                "sha256:b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991",
+                "sha256:bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69",
+                "sha256:bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf",
+                "sha256:c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb",
+                "sha256:c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b",
+                "sha256:c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833",
+                "sha256:cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76",
+                "sha256:cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85",
+                "sha256:cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e",
+                "sha256:d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50",
+                "sha256:d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8",
+                "sha256:d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4",
+                "sha256:d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b",
+                "sha256:dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5",
+                "sha256:e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190",
+                "sha256:e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7",
+                "sha256:eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa",
+                "sha256:ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0",
+                "sha256:f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9",
+                "sha256:f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0",
+                "sha256:fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b",
+                "sha256:fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5",
+                "sha256:fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7",
+                "sha256:fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            ],
+            "version": "==4.9.3"
+        },
+        "packageurl-python": {
+            "hashes": [
+                "sha256:01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471",
+                "sha256:799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            ],
+            "markers": "python_version >= '3.7'",
+            "version": "==0.11.2"
+        },
+        "py-serializable": {
+            "hashes": [
+                "sha256:8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771",
+                "sha256:d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            ],
+            "markers": "python_version >= '3.7' and python_version < '4.0'",
+            "version": "==0.15.0"
+        },
+        "python-dateutil": {
+            "hashes": [
+                "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86",
+                "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2'",
+            "version": "==2.8.2"
+        },
+        "referencing": {
+            "hashes": [
+                "sha256:81a1471c68c9d5e3831c30ad1dd9815c45b558e596653db751a2bfdd17b3b9ec",
+                "sha256:c19c4d006f1757e3dd75c4f784d38f8698d87b649c54f9ace14e5e8c9667c01d"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==0.31.1"
+        },
+        "rfc3339-validator": {
+            "hashes": [
+                "sha256:138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b",
+                "sha256:24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            ],
+            "version": "==0.1.4"
+        },
+        "rfc3987": {
+            "hashes": [
+                "sha256:10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53",
+                "sha256:d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            ],
+            "version": "==1.3.8"
+        },
+        "rpds-py": {
+            "hashes": [
+                "sha256:06d218e4464d31301e943b65b2c6919318ea6f69703a351961e1baaf60347276",
+                "sha256:12ecf89bd54734c3c2c79898ae2021dca42750c7bcfb67f8fb3315453738ac8f",
+                "sha256:15253fff410873ebf3cfba1cc686a37711efcd9b8cb30ea21bb14a973e393f60",
+                "sha256:188435794405c7f0573311747c85a96b63c954a5f2111b1df8018979eca0f2f0",
+                "sha256:1ceebd0ae4f3e9b2b6b553b51971921853ae4eebf3f54086be0565d59291e53d",
+                "sha256:244e173bb6d8f3b2f0c4d7370a1aa341f35da3e57ffd1798e5b2917b91731fd3",
+                "sha256:25b28b3d33ec0a78e944aaaed7e5e2a94ac811bcd68b557ca48a0c30f87497d2",
+                "sha256:25ea41635d22b2eb6326f58e608550e55d01df51b8a580ea7e75396bafbb28e9",
+                "sha256:29d311e44dd16d2434d5506d57ef4d7036544fc3c25c14b6992ef41f541b10fb",
+                "sha256:2a1472956c5bcc49fb0252b965239bffe801acc9394f8b7c1014ae9258e4572b",
+                "sha256:2a7bef6977043673750a88da064fd513f89505111014b4e00fbdd13329cd4e9a",
+                "sha256:2ac26f50736324beb0282c819668328d53fc38543fa61eeea2c32ea8ea6eab8d",
+                "sha256:2e72f750048b32d39e87fc85c225c50b2a6715034848dbb196bf3348aa761fa1",
+                "sha256:31e220a040b89a01505128c2f8a59ee74732f666439a03e65ccbf3824cdddae7",
+                "sha256:35f53c76a712e323c779ca39b9a81b13f219a8e3bc15f106ed1e1462d56fcfe9",
+                "sha256:38d4f822ee2f338febcc85aaa2547eb5ba31ba6ff68d10b8ec988929d23bb6b4",
+                "sha256:38f9bf2ad754b4a45b8210a6c732fe876b8a14e14d5992a8c4b7c1ef78740f53",
+                "sha256:3a44c8440183b43167fd1a0819e8356692bf5db1ad14ce140dbd40a1485f2dea",
+                "sha256:3ab96754d23372009638a402a1ed12a27711598dd49d8316a22597141962fe66",
+                "sha256:3c55d7f2d817183d43220738270efd3ce4e7a7b7cbdaefa6d551ed3d6ed89190",
+                "sha256:46e1ed994a0920f350a4547a38471217eb86f57377e9314fbaaa329b71b7dfe3",
+                "sha256:4a5375c5fff13f209527cd886dc75394f040c7d1ecad0a2cb0627f13ebe78a12",
+                "sha256:4c2d26aa03d877c9730bf005621c92da263523a1e99247590abbbe252ccb7824",
+                "sha256:4c4e314d36d4f31236a545696a480aa04ea170a0b021e9a59ab1ed94d4c3ef27",
+                "sha256:4d0c10d803549427f427085ed7aebc39832f6e818a011dcd8785e9c6a1ba9b3e",
+                "sha256:4dcc5ee1d0275cb78d443fdebd0241e58772a354a6d518b1d7af1580bbd2c4e8",
+                "sha256:51967a67ea0d7b9b5cd86036878e2d82c0b6183616961c26d825b8c994d4f2c8",
+                "sha256:530190eb0cd778363bbb7596612ded0bb9fef662daa98e9d92a0419ab27ae914",
+                "sha256:5379e49d7e80dca9811b36894493d1c1ecb4c57de05c36f5d0dd09982af20211",
+                "sha256:5493569f861fb7b05af6d048d00d773c6162415ae521b7010197c98810a14cab",
+                "sha256:5a4c1058cdae6237d97af272b326e5f78ee7ee3bbffa6b24b09db4d828810468",
+                "sha256:5d75d6d220d55cdced2f32cc22f599475dbe881229aeddba6c79c2e9df35a2b3",
+                "sha256:5d97e9ae94fb96df1ee3cb09ca376c34e8a122f36927230f4c8a97f469994bff",
+                "sha256:5feae2f9aa7270e2c071f488fab256d768e88e01b958f123a690f1cc3061a09c",
+                "sha256:603d5868f7419081d616dab7ac3cfa285296735e7350f7b1e4f548f6f953ee7d",
+                "sha256:61d42d2b08430854485135504f672c14d4fc644dd243a9c17e7c4e0faf5ed07e",
+                "sha256:61dbc1e01dc0c5875da2f7ae36d6e918dc1b8d2ce04e871793976594aad8a57a",
+                "sha256:65cfed9c807c27dee76407e8bb29e6f4e391e436774bcc769a037ff25ad8646e",
+                "sha256:67a429520e97621a763cf9b3ba27574779c4e96e49a27ff8a1aa99ee70beb28a",
+                "sha256:6aadae3042f8e6db3376d9e91f194c606c9a45273c170621d46128f35aef7cd0",
+                "sha256:6ba8858933f0c1a979781272a5f65646fca8c18c93c99c6ddb5513ad96fa54b1",
+                "sha256:6bc568b05e02cd612be53900c88aaa55012e744930ba2eeb56279db4c6676eb3",
+                "sha256:729408136ef8d45a28ee9a7411917c9e3459cf266c7e23c2f7d4bb8ef9e0da42",
+                "sha256:751758d9dd04d548ec679224cc00e3591f5ebf1ff159ed0d4aba6a0746352452",
+                "sha256:76d59d4d451ba77f08cb4cd9268dec07be5bc65f73666302dbb5061989b17198",
+                "sha256:79bf58c08f0756adba691d480b5a20e4ad23f33e1ae121584cf3a21717c36dfa",
+                "sha256:7de12b69d95072394998c622cfd7e8cea8f560db5fca6a62a148f902a1029f8b",
+                "sha256:7f55cd9cf1564b7b03f238e4c017ca4794c05b01a783e9291065cb2858d86ce4",
+                "sha256:80e5acb81cb49fd9f2d5c08f8b74ffff14ee73b10ca88297ab4619e946bcb1e1",
+                "sha256:87a90f5545fd61f6964e65eebde4dc3fa8660bb7d87adb01d4cf17e0a2b484ad",
+                "sha256:881df98f0a8404d32b6de0fd33e91c1b90ed1516a80d4d6dc69d414b8850474c",
+                "sha256:8a776a29b77fe0cc28fedfd87277b0d0f7aa930174b7e504d764e0b43a05f381",
+                "sha256:8c2a61c0e4811012b0ba9f6cdcb4437865df5d29eab5d6018ba13cee1c3064a0",
+                "sha256:8fa6bd071ec6d90f6e7baa66ae25820d57a8ab1b0a3c6d3edf1834d4b26fafa2",
+                "sha256:96f2975fb14f39c5fe75203f33dd3010fe37d1c4e33177feef1107b5ced750e3",
+                "sha256:96fb0899bb2ab353f42e5374c8f0789f54e0a94ef2f02b9ac7149c56622eaf31",
+                "sha256:97163a1ab265a1073a6372eca9f4eeb9f8c6327457a0b22ddfc4a17dcd613e74",
+                "sha256:9c95a1a290f9acf7a8f2ebbdd183e99215d491beea52d61aa2a7a7d2c618ddc6",
+                "sha256:9d94d78418203904730585efa71002286ac4c8ac0689d0eb61e3c465f9e608ff",
+                "sha256:a6ba2cb7d676e9415b9e9ac7e2aae401dc1b1e666943d1f7bc66223d3d73467b",
+                "sha256:aa0379c1935c44053c98826bc99ac95f3a5355675a297ac9ce0dfad0ce2d50ca",
+                "sha256:ac96d67b37f28e4b6ecf507c3405f52a40658c0a806dffde624a8fcb0314d5fd",
+                "sha256:ade2ccb937060c299ab0dfb2dea3d2ddf7e098ed63ee3d651ebfc2c8d1e8632a",
+                "sha256:aefbdc934115d2f9278f153952003ac52cd2650e7313750390b334518c589568",
+                "sha256:b07501b720cf060c5856f7b5626e75b8e353b5f98b9b354a21eb4bfa47e421b1",
+                "sha256:b5267feb19070bef34b8dea27e2b504ebd9d31748e3ecacb3a4101da6fcb255c",
+                "sha256:b5f6328e8e2ae8238fc767703ab7b95785521c42bb2b8790984e3477d7fa71ad",
+                "sha256:b8996ffb60c69f677245f5abdbcc623e9442bcc91ed81b6cd6187129ad1fa3e7",
+                "sha256:b981a370f8f41c4024c170b42fbe9e691ae2dbc19d1d99151a69e2c84a0d194d",
+                "sha256:b9d121be0217787a7d59a5c6195b0842d3f701007333426e5154bf72346aa658",
+                "sha256:bcef4f2d3dc603150421de85c916da19471f24d838c3c62a4f04c1eb511642c1",
+                "sha256:bed0252c85e21cf73d2d033643c945b460d6a02fc4a7d644e3b2d6f5f2956c64",
+                "sha256:bfdfbe6a36bc3059fff845d64c42f2644cf875c65f5005db54f90cdfdf1df815",
+                "sha256:c0095b8aa3e432e32d372e9a7737e65b58d5ed23b9620fea7cb81f17672f1fa1",
+                "sha256:c1f41d32a2ddc5a94df4b829b395916a4b7f103350fa76ba6de625fcb9e773ac",
+                "sha256:c45008ca79bad237cbc03c72bc5205e8c6f66403773929b1b50f7d84ef9e4d07",
+                "sha256:c82bbf7e03748417c3a88c1b0b291288ce3e4887a795a3addaa7a1cfd9e7153e",
+                "sha256:c918621ee0a3d1fe61c313f2489464f2ae3d13633e60f520a8002a5e910982ee",
+                "sha256:d204957169f0b3511fb95395a9da7d4490fb361763a9f8b32b345a7fe119cb45",
+                "sha256:d329896c40d9e1e5c7715c98529e4a188a1f2df51212fd65102b32465612b5dc",
+                "sha256:d3a61e928feddc458a55110f42f626a2a20bea942ccedb6fb4cee70b4830ed41",
+                "sha256:d48db29bd47814671afdd76c7652aefacc25cf96aad6daefa82d738ee87461e2",
+                "sha256:d5593855b5b2b73dd8413c3fdfa5d95b99d657658f947ba2c4318591e745d083",
+                "sha256:d79c159adea0f1f4617f54aa156568ac69968f9ef4d1e5fefffc0a180830308e",
+                "sha256:db09b98c7540df69d4b47218da3fbd7cb466db0fb932e971c321f1c76f155266",
+                "sha256:ddf23960cb42b69bce13045d5bc66f18c7d53774c66c13f24cf1b9c144ba3141",
+                "sha256:e06cfea0ece444571d24c18ed465bc93afb8c8d8d74422eb7026662f3d3f779b",
+                "sha256:e7c564c58cf8f248fe859a4f0fe501b050663f3d7fbc342172f259124fb59933",
+                "sha256:e86593bf8637659e6a6ed58854b6c87ec4e9e45ee8a4adfd936831cef55c2d21",
+                "sha256:eaffbd8814bb1b5dc3ea156a4c5928081ba50419f9175f4fc95269e040eff8f0",
+                "sha256:ee353bb51f648924926ed05e0122b6a0b1ae709396a80eb583449d5d477fcdf7",
+                "sha256:ee6faebb265e28920a6f23a7d4c362414b3f4bb30607141d718b991669e49ddc",
+                "sha256:efe093acc43e869348f6f2224df7f452eab63a2c60a6c6cd6b50fd35c4e075ba",
+                "sha256:f03a1b3a4c03e3e0161642ac5367f08479ab29972ea0ffcd4fa18f729cd2be0a",
+                "sha256:f0d320e70b6b2300ff6029e234e79fe44e9dbbfc7b98597ba28e054bd6606a57",
+                "sha256:f252dfb4852a527987a9156cbcae3022a30f86c9d26f4f17b8c967d7580d65d2",
+                "sha256:f5f4424cb87a20b016bfdc157ff48757b89d2cc426256961643d443c6c277007",
+                "sha256:f8eae66a1304de7368932b42d801c67969fd090ddb1a7a24f27b435ed4bed68f",
+                "sha256:fdb82eb60d31b0c033a8e8ee9f3fc7dfbaa042211131c29da29aea8531b4f18f"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==0.13.2"
+        },
+        "six": {
+            "hashes": [
+                "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
+                "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2'",
+            "version": "==1.16.0"
+        },
+        "sortedcontainers": {
+            "hashes": [
+                "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88",
+                "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            ],
+            "version": "==2.4.0"
+        },
+        "types-python-dateutil": {
+            "hashes": [
+                "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b",
+                "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            ],
+            "version": "==2.8.19.14"
+        },
+        "uri-template": {
+            "hashes": [
+                "sha256:0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7",
+                "sha256:a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            ],
+            "version": "==1.3.0"
+        },
+        "webcolors": {
+            "hashes": [
+                "sha256:29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf",
+                "sha256:c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            ],
+            "version": "==1.13"
+        }
+    },
+    "develop": {}
+}
diff --git a/tests/_data/infiles/pipenv/with-extras/pyproject.toml b/tests/_data/infiles/pipenv/with-extras/pyproject.toml
new file mode 100644
index 00000000..1420454b
--- /dev/null
+++ b/tests/_data/infiles/pipenv/with-extras/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "with-extras"
+version = "0.1.0"
+description = "depenndencies with extras"
diff --git a/tests/_data/infiles/pipenv/with-urls/Pipfile b/tests/_data/infiles/pipenv/with-urls/Pipfile
new file mode 100644
index 00000000..4c083118
--- /dev/null
+++ b/tests/_data/infiles/pipenv/with-urls/Pipfile
@@ -0,0 +1,12 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+# numpy = {file = "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"}
+pillow = {ref = "10.1.0", git = "git+https://github.com/python-pillow/Pillow.git"}
+six = {ref = "1.16.0", git = "git+ssh://git@github.com/benjaminp/six.git"}
+# wxpython-phoenix = {file = "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5624+e95b6c8b-cp311-cp311-win32.whl", markers="sys_platform == 'win32'"}
+urllib3 = {file = "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"}
+requests = {git = "git+https://github.com/requests/requests.git#egg=requests"}
+
+[dev-packages]
diff --git a/tests/_data/infiles/pipenv/with-urls/Pipfile.lock b/tests/_data/infiles/pipenv/with-urls/Pipfile.lock
new file mode 100644
index 00000000..a14c3b7d
--- /dev/null
+++ b/tests/_data/infiles/pipenv/with-urls/Pipfile.lock
@@ -0,0 +1,150 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "7da942b1b25618d83c715727e11e1bd3602acc0aff377dc95d80326e9d77fa5a"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "certifi": {
+            "hashes": [
+                "sha256:9b469f3a900bf28dc19b8cfbf8019bf47f7fdd1a65a1d4ffb98fc14166beb4d1",
+                "sha256:e036ab49d5b79556f99cfc2d9320b34cfbe5be05c5871b51de9329f0603b0474"
+            ],
+            "markers": "python_version >= '3.6'",
+            "version": "==2023.11.17"
+        },
+        "charset-normalizer": {
+            "hashes": [
+                "sha256:06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027",
+                "sha256:06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087",
+                "sha256:0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786",
+                "sha256:0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8",
+                "sha256:10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09",
+                "sha256:122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185",
+                "sha256:1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574",
+                "sha256:1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e",
+                "sha256:1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519",
+                "sha256:2127566c664442652f024c837091890cb1942c30937add288223dc895793f898",
+                "sha256:22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269",
+                "sha256:25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3",
+                "sha256:2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f",
+                "sha256:3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6",
+                "sha256:34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8",
+                "sha256:37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a",
+                "sha256:3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73",
+                "sha256:3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc",
+                "sha256:42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714",
+                "sha256:45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2",
+                "sha256:4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc",
+                "sha256:4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce",
+                "sha256:4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d",
+                "sha256:549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e",
+                "sha256:55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6",
+                "sha256:572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269",
+                "sha256:573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96",
+                "sha256:5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d",
+                "sha256:6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a",
+                "sha256:65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4",
+                "sha256:663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77",
+                "sha256:6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d",
+                "sha256:68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0",
+                "sha256:6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed",
+                "sha256:6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068",
+                "sha256:6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac",
+                "sha256:6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25",
+                "sha256:753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8",
+                "sha256:7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab",
+                "sha256:7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26",
+                "sha256:7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2",
+                "sha256:802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db",
+                "sha256:80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f",
+                "sha256:8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5",
+                "sha256:86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99",
+                "sha256:87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c",
+                "sha256:8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d",
+                "sha256:8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811",
+                "sha256:8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa",
+                "sha256:8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a",
+                "sha256:9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03",
+                "sha256:90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b",
+                "sha256:923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04",
+                "sha256:95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c",
+                "sha256:96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001",
+                "sha256:9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458",
+                "sha256:a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389",
+                "sha256:a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99",
+                "sha256:a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985",
+                "sha256:a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537",
+                "sha256:ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238",
+                "sha256:aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f",
+                "sha256:b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d",
+                "sha256:b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796",
+                "sha256:b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a",
+                "sha256:b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143",
+                "sha256:bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8",
+                "sha256:beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c",
+                "sha256:c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5",
+                "sha256:c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5",
+                "sha256:c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711",
+                "sha256:c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4",
+                "sha256:cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6",
+                "sha256:d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c",
+                "sha256:d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7",
+                "sha256:db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4",
+                "sha256:ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b",
+                "sha256:deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae",
+                "sha256:e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12",
+                "sha256:e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c",
+                "sha256:e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae",
+                "sha256:eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8",
+                "sha256:eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887",
+                "sha256:eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b",
+                "sha256:efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4",
+                "sha256:f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f",
+                "sha256:f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5",
+                "sha256:fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33",
+                "sha256:fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519",
+                "sha256:ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561"
+            ],
+            "markers": "python_full_version >= '3.7.0'",
+            "version": "==3.3.2"
+        },
+        "idna": {
+            "hashes": [
+                "sha256:9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca",
+                "sha256:c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            ],
+            "markers": "python_version >= '3.5'",
+            "version": "==3.6"
+        },
+        "pillow": {
+            "git": "git+https://github.com/python-pillow/Pillow.git",
+            "markers": "python_version >= '3.8'",
+            "ref": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        },
+        "requests": {
+            "git": "git+https://github.com/requests/requests.git#egg=requests",
+            "markers": "python_version >= '3.7'",
+            "ref": "a25fde6989f8df5c3d823bc9f2e2fc24aa71f375"
+        },
+        "six": {
+            "git": "git+ssh://git@github.com/benjaminp/six.git",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "ref": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        },
+        "urllib3": {
+            "file": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+            "markers": "python_version >= '3.8'"
+        }
+    },
+    "develop": {}
+}
diff --git a/tests/_data/infiles/pipenv/with-urls/pyproject.toml b/tests/_data/infiles/pipenv/with-urls/pyproject.toml
new file mode 100644
index 00000000..39464682
--- /dev/null
+++ b/tests/_data/infiles/pipenv/with-urls/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "with-urls"
+version = "0.1.0"
+description = "packages from direct urls"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42-py2.py3-none-any.whl b/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42-py2.py3-none-any.whl
deleted file mode 100644
index 19109874156999b0d8dd8da563cc295d4859da47..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42.tar.gz b/tests/_data/infiles/poetry/local/local_pckages/a/dist/package_a-23.42.tar.gz
deleted file mode 100644
index 14486cda5572c5fdeb4ffb846e993ef91333210c..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO
deleted file mode 100644
index 37bea4c3..00000000
--- a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/PKG-INFO
+++ /dev/null
@@ -1,18 +0,0 @@
-Metadata-Version: 2.1
-Name: package-a
-Version: 23.42
-Summary: some package A
-License: Apache-2.0
-Classifier: License :: OSI Approved :: Apache Software License
-Classifier: Programming Language :: Python :: 2
-Classifier: Programming Language :: Python :: 2.7
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.4
-Classifier: Programming Language :: Python :: 3.5
-Classifier: Programming Language :: Python :: 3.6
-Classifier: Programming Language :: Python :: 3.7
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml
deleted file mode 100644
index b99a015a..00000000
--- a/tests/_data/infiles/poetry/local/local_pckages/a/dist/unpacked/package_a-23.42/pyproject.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[tool.poetry]
-name = "package-a"
-version = "23.42"
-description = "some package A"
-license = "Apache-2.0"
-authors = []
-packages = [
-  { include = "module_a.py" }
-]
-
-[tool.poetry.dependencies]
-python = "*"
-
-
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/module_a.py b/tests/_data/infiles/poetry/local/local_pckages/a/module_a.py
deleted file mode 100644
index e804bc1a..00000000
--- a/tests/_data/infiles/poetry/local/local_pckages/a/module_a.py
+++ /dev/null
@@ -1,19 +0,0 @@
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
-"""
-module A
-"""
diff --git a/tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml
deleted file mode 100644
index b99a015a..00000000
--- a/tests/_data/infiles/poetry/local/local_pckages/a/pyproject.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[tool.poetry]
-name = "package-a"
-version = "23.42"
-description = "some package A"
-license = "Apache-2.0"
-authors = []
-packages = [
-  { include = "module_a.py" }
-]
-
-[tool.poetry.dependencies]
-python = "*"
-
-
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl b/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl
deleted file mode 100644
index 60d370d1003d237be7bb0c21492bce7bc19275cd..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7.tar.gz b/tests/_data/infiles/poetry/local/local_pckages/b/dist/package_b-1.33.7.tar.gz
deleted file mode 100644
index f7f9395e43525889020120f2a783e1bb61e9b010..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml
deleted file mode 100644
index b4745582..00000000
--- a/tests/_data/infiles/poetry/local/local_pckages/b/pyproject.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[tool.poetry]
-name = "package-b"
-version = "1.33.7"
-description = "some package B"
-license = "Apache-2.0"
-authors = []
-packages = [
-  { include = "module_b.py" }
-]
-
-[tool.poetry.dependencies]
-python = "*"
-
-
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85-py2.py3-none-any.whl b/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85-py2.py3-none-any.whl
deleted file mode 100644
index 0767bfd18ef517a93c352a342596fe05cf2234d4..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85.tar.gz b/tests/_data/infiles/poetry/local/local_pckages/c/dist/package_c-80.0.85.tar.gz
deleted file mode 100644
index d09bb80f6d23c47f47ff8a826db282165fcbe661..0000000000000000000000000000000000000000
GIT binary patch
diff --git a/tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml b/tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml
deleted file mode 100644
index cd74ea77..00000000
--- a/tests/_data/infiles/poetry/local/local_pckages/c/pyproject.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-[tool.poetry]
-name = "package-C"
-version = "80.0.85"
-description = "some package C"
-license = "Apache-2.0"
-authors = []
-packages = [
-  { include = "module_c.py" }
-]
-
-[tool.poetry.dependencies]
-python = "*"
-
-
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/poetry/local/lock10/poetry.lock b/tests/_data/infiles/poetry/local/lock10/poetry.lock
index ae5c6c0e..1896ec6a 100644
--- a/tests/_data/infiles/poetry/local/lock10/poetry.lock
+++ b/tests/_data/infiles/poetry/local/lock10/poetry.lock
@@ -1,53 +1,36 @@
 [[package]]
-category = "main"
-description = "some package A"
 name = "package-a"
-optional = false
-python-versions = "*"
 version = "23.42"
-
-[package.source]
-reference = ""
-type = "file"
-url = "../local_pckages/a/dist/package_a-23.42.tar.gz"
-
-[[package]]
+description = "some package A"
 category = "main"
-description = "some package B"
-name = "package-b"
 optional = false
-python-versions = "*"
-version = "1.33.7"
+python-versions = ">=3.8"
 
 [package.source]
-reference = ""
 type = "file"
-url = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+url = "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
 
 [[package]]
+name = "package-b"
+version = "23.42"
+description = "some package B"
 category = "main"
-description = ""
-develop = true
-name = "package-c"
 optional = false
-python-versions = "*"
-version = "80.0.85"
+python-versions = ">=3.8"
 
 [package.source]
-reference = ""
-type = "directory"
-url = "../local_pckages/c"
+type = "file"
+url = "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
 
 [metadata]
-content-hash = "4b28b28960b552d79f8976bc7bbd09ccf8fb6b3c1219785039fe47238a2f4615"
-lock-version = "1.0"
+lock-version = "1.1"
 python-versions = "^3.8"
+content-hash = "734048232bb6dda94b2a854173814b14cb126075501e789ccddc26b4a4b31c5e"
 
 [metadata.files]
 package-a = [
-    {file = "package_a-23.42.tar.gz", hash = "sha256:ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"},
+    {file = "package-a-23.42.tar.gz", hash = "sha256:3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"},
 ]
 package-b = [
-    {file = "package_b-1.33.7-py2.py3-none-any.whl", hash = "sha256:9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"},
+    {file = "package_b-23.42-py3-none-any.whl", hash = "sha256:4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"},
 ]
-package-c = []
diff --git a/tests/_data/infiles/poetry/local/lock11/poetry.lock b/tests/_data/infiles/poetry/local/lock11/poetry.lock
index 0b6e65df..60bdd06c 100644
--- a/tests/_data/infiles/poetry/local/lock11/poetry.lock
+++ b/tests/_data/infiles/poetry/local/lock11/poetry.lock
@@ -4,47 +4,47 @@ version = "23.42"
 description = "some package A"
 category = "main"
 optional = false
-python-versions = "*"
+python-versions = ">=3.8"
 
 [package.source]
 type = "file"
-url = "../local_pckages/a/dist/package_a-23.42.tar.gz"
+url = "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
 
 [[package]]
 name = "package-b"
-version = "1.33.7"
+version = "23.42"
 description = "some package B"
 category = "main"
 optional = false
-python-versions = "*"
+python-versions = ">=3.8"
 
 [package.source]
 type = "file"
-url = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+url = "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
 
 [[package]]
 name = "package-c"
-version = "80.0.85"
+version = "23.42"
 description = "some package C"
 category = "main"
 optional = false
-python-versions = "*"
+python-versions = ">=3.8"
 develop = false
 
 [package.source]
 type = "directory"
-url = "../local_pckages/c"
+url = "../../../_helpers/local_pckages/c"
 
 [metadata]
 lock-version = "1.1"
 python-versions = "^3.8"
-content-hash = "4b28b28960b552d79f8976bc7bbd09ccf8fb6b3c1219785039fe47238a2f4615"
+content-hash = "eb023411cfd4933d02aaa1b3512ce9cfe90072a81c3f580982b6da501da2cec2"
 
 [metadata.files]
 package-a = [
-    {file = "package_a-23.42.tar.gz", hash = "sha256:ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"},
+    {file = "package-a-23.42.tar.gz", hash = "sha256:3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"},
 ]
 package-b = [
-    {file = "package_b-1.33.7-py2.py3-none-any.whl", hash = "sha256:9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"},
+    {file = "package_b-23.42-py3-none-any.whl", hash = "sha256:4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"},
 ]
 package-c = []
diff --git a/tests/_data/infiles/poetry/local/lock20/poetry.lock b/tests/_data/infiles/poetry/local/lock20/poetry.lock
index 31efac25..71dc800d 100644
--- a/tests/_data/infiles/poetry/local/lock20/poetry.lock
+++ b/tests/_data/infiles/poetry/local/lock20/poetry.lock
@@ -1,47 +1,47 @@
-# This file is automatically @generated by Poetry 1.7.0 and should not be changed by hand.
+# This file is automatically @generated by Poetry 1.7.1 and should not be changed by hand.
 
 [[package]]
 name = "package-a"
 version = "23.42"
 description = "some package A"
 optional = false
-python-versions = "*"
+python-versions = ">=3.8"
 files = [
-    {file = "package_a-23.42.tar.gz", hash = "sha256:ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"},
+    {file = "package-a-23.42.tar.gz", hash = "sha256:3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"},
 ]
 
 [package.source]
 type = "file"
-url = "../local_pckages/a/dist/package_a-23.42.tar.gz"
+url = "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
 
 [[package]]
 name = "package-b"
-version = "1.33.7"
+version = "23.42"
 description = "some package B"
 optional = false
-python-versions = "*"
+python-versions = ">=3.8"
 files = [
-    {file = "package_b-1.33.7-py2.py3-none-any.whl", hash = "sha256:9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"},
+    {file = "package_b-23.42-py3-none-any.whl", hash = "sha256:4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"},
 ]
 
 [package.source]
 type = "file"
-url = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+url = "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
 
 [[package]]
 name = "package-c"
-version = "80.0.85"
+version = "23.42"
 description = "some package C"
 optional = false
-python-versions = "*"
+python-versions = ">=3.8"
 files = []
 develop = false
 
 [package.source]
 type = "directory"
-url = "../local_pckages/c"
+url = "../../../_helpers/local_pckages/c"
 
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.8"
-content-hash = "4b28b28960b552d79f8976bc7bbd09ccf8fb6b3c1219785039fe47238a2f4615"
+content-hash = "eb023411cfd4933d02aaa1b3512ce9cfe90072a81c3f580982b6da501da2cec2"
diff --git a/tests/_data/infiles/poetry/local/pyproject-proto.toml b/tests/_data/infiles/poetry/local/pyproject-proto.toml
index fbc09a20..89060cd8 100644
--- a/tests/_data/infiles/poetry/local/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/local/pyproject-proto.toml
@@ -14,9 +14,10 @@ authors = ["Your Name <you@example.com>"]
 
 [tool.poetry.dependencies]
 python = "^3.8"
-package-a = {path = "../local_pckages/a/dist/package_a-23.42.tar.gz"}
-package-b = {path = "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"}
-package-c = {path = "../local_pckages/c"}
+package-a = {path = "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"}
+package-b = {path = "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"}
+# package-c not in poetry v1.0 available
+package-c = {path = "../../../_helpers/local_pckages/c"}
 
 
 
diff --git a/tests/_data/infiles/poetry/private-packges/pyproject-proto.toml b/tests/_data/infiles/poetry/private-packges/pyproject-proto.toml
index 57d603b5..413ad296 100644
--- a/tests/_data/infiles/poetry/private-packges/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/private-packges/pyproject-proto.toml
@@ -6,7 +6,7 @@ authors = ["Your Name <you@example.com>"]
 
 
 # see https://python-poetry.org/docs/repositories/
-# run the `pypi-proxy.py` to setup a pypi proxy
+# run the `//tests/_data/infiles/_helpers/pypi-proxy.py` to setup a PyPI proxy
 
 
 [[tool.poetry.source]]
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.0.xml.bin b/tests/_data/snapshots/pipenv/category-deps_1.0.xml.bin
new file mode 100644
index 00000000..3c181bc6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.0.xml.bin
@@ -0,0 +1,11 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.1.xml.bin b/tests/_data/snapshots/pipenv/category-deps_1.1.xml.bin
new file mode 100644
index 00000000..77e5b3e3
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.1.xml.bin
@@ -0,0 +1,16 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.2.json.bin b/tests/_data/snapshots/pipenv/category-deps_1.2.json.bin
new file mode 100644
index 00000000..29db2b69
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.2.json.bin
@@ -0,0 +1,51 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "dependencies organized in groups",
+      "name": "category-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.2.xml.bin b/tests/_data/snapshots/pipenv/category-deps_1.2.xml.bin
new file mode 100644
index 00000000..8bb75f31
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.2.xml.bin
@@ -0,0 +1,39 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>category-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/category-deps_1.3.json.bin
new file mode 100644
index 00000000..8f03271c
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.3.json.bin
@@ -0,0 +1,67 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "dependencies organized in groups",
+      "name": "category-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/category-deps_1.3.xml.bin
new file mode 100644
index 00000000..2d69fbd9
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.3.xml.bin
@@ -0,0 +1,46 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>category-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/category-deps_1.4.json.bin
new file mode 100644
index 00000000..d5f82957
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.4.json.bin
@@ -0,0 +1,63 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "dependencies organized in groups",
+      "name": "category-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/category-deps_1.4.xml.bin
new file mode 100644
index 00000000..d94d68c7
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.4.xml.bin
@@ -0,0 +1,73 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>category-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.0.xml.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.0.xml.bin
new file mode 100644
index 00000000..57fe8bce
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.0.xml.bin
@@ -0,0 +1,17 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.1.xml.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.1.xml.bin
new file mode 100644
index 00000000..32343469
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.1.xml.bin
@@ -0,0 +1,27 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.2.json.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.2.json.bin
new file mode 100644
index 00000000..0e111c17
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.2.json.bin
@@ -0,0 +1,68 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "default and dev depenndencies",
+      "name": "default-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.2.xml.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.2.xml.bin
new file mode 100644
index 00000000..63499151
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.2.xml.bin
@@ -0,0 +1,51 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>default-and-dev</name>
+      <version>0.1.0</version>
+      <description>default and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.3.json.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.3.json.bin
new file mode 100644
index 00000000..61d5a130
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.3.json.bin
@@ -0,0 +1,100 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "default and dev depenndencies",
+      "name": "default-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.3.xml.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.3.xml.bin
new file mode 100644
index 00000000..c8e64be6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.3.xml.bin
@@ -0,0 +1,65 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>default-and-dev</name>
+      <version>0.1.0</version>
+      <description>default and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.4.json.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.4.json.bin
new file mode 100644
index 00000000..408580c6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.4.json.bin
@@ -0,0 +1,96 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "default and dev depenndencies",
+      "name": "default-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.4.xml.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.4.xml.bin
new file mode 100644
index 00000000..dedb7066
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.4.xml.bin
@@ -0,0 +1,92 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>default-and-dev</name>
+      <version>0.1.0</version>
+      <description>default and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.0.xml.bin b/tests/_data/snapshots/pipenv/editable-self_1.0.xml.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.0.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.1.xml.bin b/tests/_data/snapshots/pipenv/editable-self_1.1.xml.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.1.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.2.json.bin b/tests/_data/snapshots/pipenv/editable-self_1.2.json.bin
new file mode 100644
index 00000000..acc0bc18
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.2.json.bin
@@ -0,0 +1,32 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.2.xml.bin b/tests/_data/snapshots/pipenv/editable-self_1.2.xml.bin
new file mode 100644
index 00000000..914a56f6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.2.xml.bin
@@ -0,0 +1,25 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.3.json.bin b/tests/_data/snapshots/pipenv/editable-self_1.3.json.bin
new file mode 100644
index 00000000..84b8ac78
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.3.json.bin
@@ -0,0 +1,38 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.3.xml.bin b/tests/_data/snapshots/pipenv/editable-self_1.3.xml.bin
new file mode 100644
index 00000000..d3dac7d0
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.3.xml.bin
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.4.json.bin b/tests/_data/snapshots/pipenv/editable-self_1.4.json.bin
new file mode 100644
index 00000000..3d61f138
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.4.json.bin
@@ -0,0 +1,34 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.4.xml.bin b/tests/_data/snapshots/pipenv/editable-self_1.4.xml.bin
new file mode 100644
index 00000000..cca4514a
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.4.xml.bin
@@ -0,0 +1,55 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/local_1.0.xml.bin b/tests/_data/snapshots/pipenv/local_1.0.xml.bin
new file mode 100644
index 00000000..718c0b43
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.0.xml.bin
@@ -0,0 +1,20 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>package-a</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-b</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-c</name>
+      <version/>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/local_1.1.xml.bin b/tests/_data/snapshots/pipenv/local_1.1.xml.bin
new file mode 100644
index 00000000..0fe51c16
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.1.xml.bin
@@ -0,0 +1,35 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="package-a">
+      <name>package-a</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b">
+      <name>package-b</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c">
+      <name>package-c</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/c</url>
+          <comment>from path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/local_1.2.json.bin b/tests/_data/snapshots/pipenv/local_1.2.json.bin
new file mode 100644
index 00000000..b2a62add
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.2.json.bin
@@ -0,0 +1,82 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-b",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-c",
+      "externalReferences": [
+        {
+          "comment": "from path",
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a"
+    },
+    {
+      "ref": "package-b"
+    },
+    {
+      "ref": "package-c"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/local_1.2.xml.bin b/tests/_data/snapshots/pipenv/local_1.2.xml.bin
new file mode 100644
index 00000000..f520d6c9
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.2.xml.bin
@@ -0,0 +1,60 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a">
+      <name>package-a</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b">
+      <name>package-b</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c">
+      <name>package-c</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/c</url>
+          <comment>from path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a"/>
+    <dependency ref="package-b"/>
+    <dependency ref="package-c"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/local_1.3.json.bin b/tests/_data/snapshots/pipenv/local_1.3.json.bin
new file mode 100644
index 00000000..c450c714
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.3.json.bin
@@ -0,0 +1,112 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-b",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
+            }
+          ],
+          "type": "distribution",
+          "url": "file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "package-c",
+      "externalReferences": [
+        {
+          "comment": "from path",
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a"
+    },
+    {
+      "ref": "package-b"
+    },
+    {
+      "ref": "package-c"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/local_1.3.xml.bin b/tests/_data/snapshots/pipenv/local_1.3.xml.bin
new file mode 100644
index 00000000..d24ac95e
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.3.xml.bin
@@ -0,0 +1,75 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a">
+      <name>package-a</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b">
+      <name>package-b</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c">
+      <name>package-c</name>
+      <version/>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/c</url>
+          <comment>from path</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a"/>
+    <dependency ref="package-b"/>
+    <dependency ref="package-c"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/local_1.4.json.bin b/tests/_data/snapshots/pipenv/local_1.4.json.bin
new file mode 100644
index 00000000..0a298451
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.4.json.bin
@@ -0,0 +1,105 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library"
+    },
+    {
+      "bom-ref": "package-b",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
+            }
+          ],
+          "type": "distribution",
+          "url": "file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library"
+    },
+    {
+      "bom-ref": "package-c",
+      "externalReferences": [
+        {
+          "comment": "from path",
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a"
+    },
+    {
+      "ref": "package-b"
+    },
+    {
+      "ref": "package-c"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/local_1.4.xml.bin b/tests/_data/snapshots/pipenv/local_1.4.xml.bin
new file mode 100644
index 00000000..6cf6c55b
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.4.xml.bin
@@ -0,0 +1,99 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a">
+      <name>package-a</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b">
+      <name>package-b</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c">
+      <name>package-c</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/c</url>
+          <comment>from path</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a"/>
+    <dependency ref="package-b"/>
+    <dependency ref="package-c"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.0.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.0.xml.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.0.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.1.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.1.xml.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.1.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin b/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin
new file mode 100644
index 00000000..e4aad8d6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin
@@ -0,0 +1,32 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin
new file mode 100644
index 00000000..88a98c86
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin
@@ -0,0 +1,25 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin
new file mode 100644
index 00000000..1ba0aca5
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin
@@ -0,0 +1,32 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin
new file mode 100644
index 00000000..ebd0be55
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin
@@ -0,0 +1,25 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin
new file mode 100644
index 00000000..5387d361
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin
@@ -0,0 +1,28 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin
new file mode 100644
index 00000000..453617f7
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin
@@ -0,0 +1,52 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.0.xml.bin b/tests/_data/snapshots/pipenv/private-packages_1.0.xml.bin
new file mode 100644
index 00000000..26921e83
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.1.xml.bin b/tests/_data/snapshots/pipenv/private-packages_1.1.xml.bin
new file mode 100644
index 00000000..a0c73e3f
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.1.xml.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.2.json.bin b/tests/_data/snapshots/pipenv/private-packages_1.2.json.bin
new file mode 100644
index 00000000..452601fc
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.2.json.bin
@@ -0,0 +1,85 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.26.2",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.2.xml.bin b/tests/_data/snapshots/pipenv/private-packages_1.2.xml.bin
new file mode 100644
index 00000000..545c9a73
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.2.xml.bin
@@ -0,0 +1,63 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.3.json.bin b/tests/_data/snapshots/pipenv/private-packages_1.3.json.bin
new file mode 100644
index 00000000..d71bd4aa
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.3.json.bin
@@ -0,0 +1,133 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.2",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.3.xml.bin b/tests/_data/snapshots/pipenv/private-packages_1.3.xml.bin
new file mode 100644
index 00000000..154e24d5
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.3.xml.bin
@@ -0,0 +1,84 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b</hash>
+            <hash alg="SHA-256">f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.4.json.bin b/tests/_data/snapshots/pipenv/private-packages_1.4.json.bin
new file mode 100644
index 00000000..af5b7b5b
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.4.json.bin
@@ -0,0 +1,129 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.2",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.4.xml.bin b/tests/_data/snapshots/pipenv/private-packages_1.4.xml.bin
new file mode 100644
index 00000000..e3761d08
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.4.xml.bin
@@ -0,0 +1,111 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b</hash>
+            <hash alg="SHA-256">f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.0.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.0.xml.bin
new file mode 100644
index 00000000..b82f51c6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.1.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.1.xml.bin
new file mode 100644
index 00000000..f115b772
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.1.xml.bin
@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.json.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.json.bin
new file mode 100644
index 00000000..206ebb83
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.json.bin
@@ -0,0 +1,75 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.xml.bin
new file mode 100644
index 00000000..f107241c
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.2.xml.bin
@@ -0,0 +1,57 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin
new file mode 100644
index 00000000..9c9504ac
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin
@@ -0,0 +1,123 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin
new file mode 100644
index 00000000..f04a1c02
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b</hash>
+            <hash alg="SHA-256">f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin
new file mode 100644
index 00000000..d32604bb
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin
@@ -0,0 +1,119 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin
new file mode 100644
index 00000000..c7bb8ba7
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin
@@ -0,0 +1,105 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b</hash>
+            <hash alg="SHA-256">f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.0.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.0.xml.bin
new file mode 100644
index 00000000..2606449f
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.0.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.1.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.1.xml.bin
new file mode 100644
index 00000000..a67ad6b2
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.1.xml.bin
@@ -0,0 +1,93 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt==1.7.0">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.json.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.json.bin
new file mode 100644
index 00000000..9f24c8d3
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.json.bin
@@ -0,0 +1,160 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt==1.7.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/"
+        }
+      ],
+      "name": "ddt",
+      "purl": "pkg:pypi/ddt@1.7.0",
+      "type": "library",
+      "version": "1.7.0"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "ddt==1.7.0"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.xml.bin
new file mode 100644
index 00000000..6e2744f7
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.2.xml.bin
@@ -0,0 +1,117 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt==1.7.0">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="ddt==1.7.0"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin
new file mode 100644
index 00000000..e56ecab7
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin
@@ -0,0 +1,292 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "categoryB"
+        },
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt==1.7.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.7.0",
+      "type": "library",
+      "version": "1.7.0"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "ddt==1.7.0"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin
new file mode 100644
index 00000000..d7cd5fa9
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin
@@ -0,0 +1,174 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">categoryB</property>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt==1.7.0">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="ddt==1.7.0"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin
new file mode 100644
index 00000000..acaedf8b
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin
@@ -0,0 +1,288 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "categoryB"
+        },
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt==1.7.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.7.0",
+      "type": "library",
+      "version": "1.7.0"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "ddt==1.7.0"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin
new file mode 100644
index 00000000..b0b3a9af
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin
@@ -0,0 +1,201 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">categoryB</property>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt==1.7.0">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="ddt==1.7.0"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.0.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.0.xml.bin
new file mode 100644
index 00000000..ab965ead
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.0.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.1.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.1.xml.bin
new file mode 100644
index 00000000..aa16d39d
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.1.xml.bin
@@ -0,0 +1,82 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.json.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.json.bin
new file mode 100644
index 00000000..affd82b1
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.json.bin
@@ -0,0 +1,143 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.xml.bin
new file mode 100644
index 00000000..dc016405
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.2.xml.bin
@@ -0,0 +1,105 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin
new file mode 100644
index 00000000..5395d5fa
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin
@@ -0,0 +1,255 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin
new file mode 100644
index 00000000..b947f9e8
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin
@@ -0,0 +1,154 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin
new file mode 100644
index 00000000..1b20c0ac
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin
@@ -0,0 +1,251 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin
new file mode 100644
index 00000000..ecafcdc3
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin
@@ -0,0 +1,181 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.0.xml.bin b/tests/_data/snapshots/pipenv/with-extras_1.0.xml.bin
new file mode 100644
index 00000000..feca9cd7
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.0.xml.bin
@@ -0,0 +1,155 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>referencing</name>
+      <version>0.31.1</version>
+      <purl>pkg:pypi/referencing@0.31.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rpds-py</name>
+      <version>0.13.2</version>
+      <purl>pkg:pypi/rpds-py@0.13.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.1.xml.bin b/tests/_data/snapshots/pipenv/with-extras_1.1.xml.bin
new file mode 100644
index 00000000..7d3c4504
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.1.xml.bin
@@ -0,0 +1,280 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean.py/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing==0.31.1">
+      <name>referencing</name>
+      <version>0.31.1</version>
+      <purl>pkg:pypi/referencing@0.31.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.13.2">
+      <name>rpds-py</name>
+      <version>0.13.2</version>
+      <purl>pkg:pypi/rpds-py@0.13.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.2.json.bin b/tests/_data/snapshots/pipenv/with-extras_1.2.json.bin
new file mode 100644
index 00000000..99ec13a2
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.2.json.bin
@@ -0,0 +1,459 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean.py/"
+        }
+      ],
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==5.1.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/"
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.3",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python==0.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable==0.15.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.31.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.31.1",
+      "type": "library",
+      "version": "0.31.1"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.13.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.13.2",
+      "type": "library",
+      "version": "0.13.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib==5.1.1"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.3"
+    },
+    {
+      "ref": "packageurl-python==0.11.2"
+    },
+    {
+      "ref": "py-serializable==0.15.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "referencing==0.31.1"
+    },
+    {
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.13.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.2.xml.bin b/tests/_data/snapshots/pipenv/with-extras_1.2.xml.bin
new file mode 100644
index 00000000..22bbe3c0
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.2.xml.bin
@@ -0,0 +1,327 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean.py/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing==0.31.1">
+      <name>referencing</name>
+      <version>0.31.1</version>
+      <purl>pkg:pypi/referencing@0.31.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.13.2">
+      <name>rpds-py</name>
+      <version>0.13.2</version>
+      <purl>pkg:pypi/rpds-py@0.13.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="attrs==23.1.0"/>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==5.1.1"/>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2"/>
+    <dependency ref="jsonschema==4.20.0"/>
+    <dependency ref="license-expression==30.2.0"/>
+    <dependency ref="lxml==4.9.3"/>
+    <dependency ref="packageurl-python==0.11.2"/>
+    <dependency ref="py-serializable==0.15.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="referencing==0.31.1"/>
+    <dependency ref="rfc3339-validator==0.1.4"/>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.13.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.3.json.bin b/tests/_data/snapshots/pipenv/with-extras_1.3.json.bin
new file mode 100644
index 00000000..9a7e72ad
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.3.json.bin
@@ -0,0 +1,1619 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/"
+        }
+      ],
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean.py/"
+        }
+      ],
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==5.1.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/"
+        }
+      ],
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/"
+        }
+      ],
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/"
+        }
+      ],
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f614fd46d8d61258610998997743ec5492a648b33cf478c1ddc23ed4598a5fa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ed6231f0429ecf966f5bc8dfef245998220549cbbcf140f913b7464c52c3b6b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/"
+        }
+      ],
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9472fc4fea474cd74bea4a2b190daeccb5a9e4db2ea80efcf7a1b582fc9a81b8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e74ba7c0a65e8cb49dc26837d6cfe576557084a8b423ed16a420984228104f93"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1a7dc2bb2d09cdc983d072e4f9adc787e107e09def84cbb3919baaaf4f8e6fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "599928edd995c43fc335e0af342076144dc71cb858afa1ed9c1c30c4e81794f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/"
+        }
+      ],
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.3",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/"
+        }
+      ],
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python==0.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable==0.15.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/"
+        }
+      ],
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.31.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81a1471c68c9d5e3831c30ad1dd9815c45b558e596653db751a2bfdd17b3b9ec"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c19c4d006f1757e3dd75c4f784d38f8698d87b649c54f9ace14e5e8c9667c01d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/"
+        }
+      ],
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.31.1",
+      "type": "library",
+      "version": "0.31.1"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/"
+        }
+      ],
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.13.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06d218e4464d31301e943b65b2c6919318ea6f69703a351961e1baaf60347276"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "12ecf89bd54734c3c2c79898ae2021dca42750c7bcfb67f8fb3315453738ac8f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "15253fff410873ebf3cfba1cc686a37711efcd9b8cb30ea21bb14a973e393f60"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "188435794405c7f0573311747c85a96b63c954a5f2111b1df8018979eca0f2f0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1ceebd0ae4f3e9b2b6b553b51971921853ae4eebf3f54086be0565d59291e53d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "244e173bb6d8f3b2f0c4d7370a1aa341f35da3e57ffd1798e5b2917b91731fd3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25b28b3d33ec0a78e944aaaed7e5e2a94ac811bcd68b557ca48a0c30f87497d2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25ea41635d22b2eb6326f58e608550e55d01df51b8a580ea7e75396bafbb28e9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "29d311e44dd16d2434d5506d57ef4d7036544fc3c25c14b6992ef41f541b10fb"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2a1472956c5bcc49fb0252b965239bffe801acc9394f8b7c1014ae9258e4572b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2a7bef6977043673750a88da064fd513f89505111014b4e00fbdd13329cd4e9a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2ac26f50736324beb0282c819668328d53fc38543fa61eeea2c32ea8ea6eab8d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2e72f750048b32d39e87fc85c225c50b2a6715034848dbb196bf3348aa761fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "31e220a040b89a01505128c2f8a59ee74732f666439a03e65ccbf3824cdddae7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "35f53c76a712e323c779ca39b9a81b13f219a8e3bc15f106ed1e1462d56fcfe9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "38d4f822ee2f338febcc85aaa2547eb5ba31ba6ff68d10b8ec988929d23bb6b4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "38f9bf2ad754b4a45b8210a6c732fe876b8a14e14d5992a8c4b7c1ef78740f53"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3a44c8440183b43167fd1a0819e8356692bf5db1ad14ce140dbd40a1485f2dea"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3ab96754d23372009638a402a1ed12a27711598dd49d8316a22597141962fe66"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3c55d7f2d817183d43220738270efd3ce4e7a7b7cbdaefa6d551ed3d6ed89190"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "46e1ed994a0920f350a4547a38471217eb86f57377e9314fbaaa329b71b7dfe3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4a5375c5fff13f209527cd886dc75394f040c7d1ecad0a2cb0627f13ebe78a12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c2d26aa03d877c9730bf005621c92da263523a1e99247590abbbe252ccb7824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c4e314d36d4f31236a545696a480aa04ea170a0b021e9a59ab1ed94d4c3ef27"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d0c10d803549427f427085ed7aebc39832f6e818a011dcd8785e9c6a1ba9b3e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4dcc5ee1d0275cb78d443fdebd0241e58772a354a6d518b1d7af1580bbd2c4e8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "51967a67ea0d7b9b5cd86036878e2d82c0b6183616961c26d825b8c994d4f2c8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "530190eb0cd778363bbb7596612ded0bb9fef662daa98e9d92a0419ab27ae914"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5379e49d7e80dca9811b36894493d1c1ecb4c57de05c36f5d0dd09982af20211"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5493569f861fb7b05af6d048d00d773c6162415ae521b7010197c98810a14cab"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5a4c1058cdae6237d97af272b326e5f78ee7ee3bbffa6b24b09db4d828810468"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5d75d6d220d55cdced2f32cc22f599475dbe881229aeddba6c79c2e9df35a2b3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5d97e9ae94fb96df1ee3cb09ca376c34e8a122f36927230f4c8a97f469994bff"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5feae2f9aa7270e2c071f488fab256d768e88e01b958f123a690f1cc3061a09c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "603d5868f7419081d616dab7ac3cfa285296735e7350f7b1e4f548f6f953ee7d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "61d42d2b08430854485135504f672c14d4fc644dd243a9c17e7c4e0faf5ed07e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "61dbc1e01dc0c5875da2f7ae36d6e918dc1b8d2ce04e871793976594aad8a57a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65cfed9c807c27dee76407e8bb29e6f4e391e436774bcc769a037ff25ad8646e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "67a429520e97621a763cf9b3ba27574779c4e96e49a27ff8a1aa99ee70beb28a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6aadae3042f8e6db3376d9e91f194c606c9a45273c170621d46128f35aef7cd0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ba8858933f0c1a979781272a5f65646fca8c18c93c99c6ddb5513ad96fa54b1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6bc568b05e02cd612be53900c88aaa55012e744930ba2eeb56279db4c6676eb3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "729408136ef8d45a28ee9a7411917c9e3459cf266c7e23c2f7d4bb8ef9e0da42"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "751758d9dd04d548ec679224cc00e3591f5ebf1ff159ed0d4aba6a0746352452"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "76d59d4d451ba77f08cb4cd9268dec07be5bc65f73666302dbb5061989b17198"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "79bf58c08f0756adba691d480b5a20e4ad23f33e1ae121584cf3a21717c36dfa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7de12b69d95072394998c622cfd7e8cea8f560db5fca6a62a148f902a1029f8b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7f55cd9cf1564b7b03f238e4c017ca4794c05b01a783e9291065cb2858d86ce4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "80e5acb81cb49fd9f2d5c08f8b74ffff14ee73b10ca88297ab4619e946bcb1e1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "87a90f5545fd61f6964e65eebde4dc3fa8660bb7d87adb01d4cf17e0a2b484ad"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "881df98f0a8404d32b6de0fd33e91c1b90ed1516a80d4d6dc69d414b8850474c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8a776a29b77fe0cc28fedfd87277b0d0f7aa930174b7e504d764e0b43a05f381"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8c2a61c0e4811012b0ba9f6cdcb4437865df5d29eab5d6018ba13cee1c3064a0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8fa6bd071ec6d90f6e7baa66ae25820d57a8ab1b0a3c6d3edf1834d4b26fafa2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96f2975fb14f39c5fe75203f33dd3010fe37d1c4e33177feef1107b5ced750e3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96fb0899bb2ab353f42e5374c8f0789f54e0a94ef2f02b9ac7149c56622eaf31"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "97163a1ab265a1073a6372eca9f4eeb9f8c6327457a0b22ddfc4a17dcd613e74"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9c95a1a290f9acf7a8f2ebbdd183e99215d491beea52d61aa2a7a7d2c618ddc6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9d94d78418203904730585efa71002286ac4c8ac0689d0eb61e3c465f9e608ff"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a6ba2cb7d676e9415b9e9ac7e2aae401dc1b1e666943d1f7bc66223d3d73467b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aa0379c1935c44053c98826bc99ac95f3a5355675a297ac9ce0dfad0ce2d50ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ac96d67b37f28e4b6ecf507c3405f52a40658c0a806dffde624a8fcb0314d5fd"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ade2ccb937060c299ab0dfb2dea3d2ddf7e098ed63ee3d651ebfc2c8d1e8632a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aefbdc934115d2f9278f153952003ac52cd2650e7313750390b334518c589568"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b07501b720cf060c5856f7b5626e75b8e353b5f98b9b354a21eb4bfa47e421b1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b5267feb19070bef34b8dea27e2b504ebd9d31748e3ecacb3a4101da6fcb255c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b5f6328e8e2ae8238fc767703ab7b95785521c42bb2b8790984e3477d7fa71ad"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b8996ffb60c69f677245f5abdbcc623e9442bcc91ed81b6cd6187129ad1fa3e7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b981a370f8f41c4024c170b42fbe9e691ae2dbc19d1d99151a69e2c84a0d194d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b9d121be0217787a7d59a5c6195b0842d3f701007333426e5154bf72346aa658"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bcef4f2d3dc603150421de85c916da19471f24d838c3c62a4f04c1eb511642c1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bed0252c85e21cf73d2d033643c945b460d6a02fc4a7d644e3b2d6f5f2956c64"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bfdfbe6a36bc3059fff845d64c42f2644cf875c65f5005db54f90cdfdf1df815"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c0095b8aa3e432e32d372e9a7737e65b58d5ed23b9620fea7cb81f17672f1fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c1f41d32a2ddc5a94df4b829b395916a4b7f103350fa76ba6de625fcb9e773ac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c45008ca79bad237cbc03c72bc5205e8c6f66403773929b1b50f7d84ef9e4d07"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c82bbf7e03748417c3a88c1b0b291288ce3e4887a795a3addaa7a1cfd9e7153e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c918621ee0a3d1fe61c313f2489464f2ae3d13633e60f520a8002a5e910982ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d204957169f0b3511fb95395a9da7d4490fb361763a9f8b32b345a7fe119cb45"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d329896c40d9e1e5c7715c98529e4a188a1f2df51212fd65102b32465612b5dc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3a61e928feddc458a55110f42f626a2a20bea942ccedb6fb4cee70b4830ed41"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d48db29bd47814671afdd76c7652aefacc25cf96aad6daefa82d738ee87461e2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d5593855b5b2b73dd8413c3fdfa5d95b99d657658f947ba2c4318591e745d083"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d79c159adea0f1f4617f54aa156568ac69968f9ef4d1e5fefffc0a180830308e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "db09b98c7540df69d4b47218da3fbd7cb466db0fb932e971c321f1c76f155266"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ddf23960cb42b69bce13045d5bc66f18c7d53774c66c13f24cf1b9c144ba3141"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e06cfea0ece444571d24c18ed465bc93afb8c8d8d74422eb7026662f3d3f779b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e7c564c58cf8f248fe859a4f0fe501b050663f3d7fbc342172f259124fb59933"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e86593bf8637659e6a6ed58854b6c87ec4e9e45ee8a4adfd936831cef55c2d21"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eaffbd8814bb1b5dc3ea156a4c5928081ba50419f9175f4fc95269e040eff8f0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ee353bb51f648924926ed05e0122b6a0b1ae709396a80eb583449d5d477fcdf7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ee6faebb265e28920a6f23a7d4c362414b3f4bb30607141d718b991669e49ddc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "efe093acc43e869348f6f2224df7f452eab63a2c60a6c6cd6b50fd35c4e075ba"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f03a1b3a4c03e3e0161642ac5367f08479ab29972ea0ffcd4fa18f729cd2be0a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f0d320e70b6b2300ff6029e234e79fe44e9dbbfc7b98597ba28e054bd6606a57"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f252dfb4852a527987a9156cbcae3022a30f86c9d26f4f17b8c967d7580d65d2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f5f4424cb87a20b016bfdc157ff48757b89d2cc426256961643d443c6c277007"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f8eae66a1304de7368932b42d801c67969fd090ddb1a7a24f27b435ed4bed68f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fdb82eb60d31b0c033a8e8ee9f3fc7dfbaa042211131c29da29aea8531b4f18f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/"
+        }
+      ],
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.13.2",
+      "type": "library",
+      "version": "0.13.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/"
+        }
+      ],
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/"
+        }
+      ],
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/"
+        }
+      ],
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib==5.1.1"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.3"
+    },
+    {
+      "ref": "packageurl-python==0.11.2"
+    },
+    {
+      "ref": "py-serializable==0.15.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "referencing==0.31.1"
+    },
+    {
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.13.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.3.xml.bin b/tests/_data/snapshots/pipenv/with-extras_1.3.xml.bin
new file mode 100644
index 00000000..8fb1e950
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.3.xml.bin
@@ -0,0 +1,692 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean.py/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca</hash>
+            <hash alg="SHA-256">c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">4f614fd46d8d61258610998997743ec5492a648b33cf478c1ddc23ed4598a5fa</hash>
+            <hash alg="SHA-256">ed6231f0429ecf966f5bc8dfef245998220549cbbcf140f913b7464c52c3b6b3</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+        <property name="cdx:python:package:extra">format</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9472fc4fea474cd74bea4a2b190daeccb5a9e4db2ea80efcf7a1b582fc9a81b8</hash>
+            <hash alg="SHA-256">e74ba7c0a65e8cb49dc26837d6cfe576557084a8b423ed16a420984228104f93</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1a7dc2bb2d09cdc983d072e4f9adc787e107e09def84cbb3919baaaf4f8e6fa1</hash>
+            <hash alg="SHA-256">599928edd995c43fc335e0af342076144dc71cb858afa1ed9c1c30c4e81794f5</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing==0.31.1">
+      <name>referencing</name>
+      <version>0.31.1</version>
+      <purl>pkg:pypi/referencing@0.31.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">81a1471c68c9d5e3831c30ad1dd9815c45b558e596653db751a2bfdd17b3b9ec</hash>
+            <hash alg="SHA-256">c19c4d006f1757e3dd75c4f784d38f8698d87b649c54f9ace14e5e8c9667c01d</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.13.2">
+      <name>rpds-py</name>
+      <version>0.13.2</version>
+      <purl>pkg:pypi/rpds-py@0.13.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">06d218e4464d31301e943b65b2c6919318ea6f69703a351961e1baaf60347276</hash>
+            <hash alg="SHA-256">12ecf89bd54734c3c2c79898ae2021dca42750c7bcfb67f8fb3315453738ac8f</hash>
+            <hash alg="SHA-256">15253fff410873ebf3cfba1cc686a37711efcd9b8cb30ea21bb14a973e393f60</hash>
+            <hash alg="SHA-256">188435794405c7f0573311747c85a96b63c954a5f2111b1df8018979eca0f2f0</hash>
+            <hash alg="SHA-256">1ceebd0ae4f3e9b2b6b553b51971921853ae4eebf3f54086be0565d59291e53d</hash>
+            <hash alg="SHA-256">244e173bb6d8f3b2f0c4d7370a1aa341f35da3e57ffd1798e5b2917b91731fd3</hash>
+            <hash alg="SHA-256">25b28b3d33ec0a78e944aaaed7e5e2a94ac811bcd68b557ca48a0c30f87497d2</hash>
+            <hash alg="SHA-256">25ea41635d22b2eb6326f58e608550e55d01df51b8a580ea7e75396bafbb28e9</hash>
+            <hash alg="SHA-256">29d311e44dd16d2434d5506d57ef4d7036544fc3c25c14b6992ef41f541b10fb</hash>
+            <hash alg="SHA-256">2a1472956c5bcc49fb0252b965239bffe801acc9394f8b7c1014ae9258e4572b</hash>
+            <hash alg="SHA-256">2a7bef6977043673750a88da064fd513f89505111014b4e00fbdd13329cd4e9a</hash>
+            <hash alg="SHA-256">2ac26f50736324beb0282c819668328d53fc38543fa61eeea2c32ea8ea6eab8d</hash>
+            <hash alg="SHA-256">2e72f750048b32d39e87fc85c225c50b2a6715034848dbb196bf3348aa761fa1</hash>
+            <hash alg="SHA-256">31e220a040b89a01505128c2f8a59ee74732f666439a03e65ccbf3824cdddae7</hash>
+            <hash alg="SHA-256">35f53c76a712e323c779ca39b9a81b13f219a8e3bc15f106ed1e1462d56fcfe9</hash>
+            <hash alg="SHA-256">38d4f822ee2f338febcc85aaa2547eb5ba31ba6ff68d10b8ec988929d23bb6b4</hash>
+            <hash alg="SHA-256">38f9bf2ad754b4a45b8210a6c732fe876b8a14e14d5992a8c4b7c1ef78740f53</hash>
+            <hash alg="SHA-256">3a44c8440183b43167fd1a0819e8356692bf5db1ad14ce140dbd40a1485f2dea</hash>
+            <hash alg="SHA-256">3ab96754d23372009638a402a1ed12a27711598dd49d8316a22597141962fe66</hash>
+            <hash alg="SHA-256">3c55d7f2d817183d43220738270efd3ce4e7a7b7cbdaefa6d551ed3d6ed89190</hash>
+            <hash alg="SHA-256">46e1ed994a0920f350a4547a38471217eb86f57377e9314fbaaa329b71b7dfe3</hash>
+            <hash alg="SHA-256">4a5375c5fff13f209527cd886dc75394f040c7d1ecad0a2cb0627f13ebe78a12</hash>
+            <hash alg="SHA-256">4c2d26aa03d877c9730bf005621c92da263523a1e99247590abbbe252ccb7824</hash>
+            <hash alg="SHA-256">4c4e314d36d4f31236a545696a480aa04ea170a0b021e9a59ab1ed94d4c3ef27</hash>
+            <hash alg="SHA-256">4d0c10d803549427f427085ed7aebc39832f6e818a011dcd8785e9c6a1ba9b3e</hash>
+            <hash alg="SHA-256">4dcc5ee1d0275cb78d443fdebd0241e58772a354a6d518b1d7af1580bbd2c4e8</hash>
+            <hash alg="SHA-256">51967a67ea0d7b9b5cd86036878e2d82c0b6183616961c26d825b8c994d4f2c8</hash>
+            <hash alg="SHA-256">530190eb0cd778363bbb7596612ded0bb9fef662daa98e9d92a0419ab27ae914</hash>
+            <hash alg="SHA-256">5379e49d7e80dca9811b36894493d1c1ecb4c57de05c36f5d0dd09982af20211</hash>
+            <hash alg="SHA-256">5493569f861fb7b05af6d048d00d773c6162415ae521b7010197c98810a14cab</hash>
+            <hash alg="SHA-256">5a4c1058cdae6237d97af272b326e5f78ee7ee3bbffa6b24b09db4d828810468</hash>
+            <hash alg="SHA-256">5d75d6d220d55cdced2f32cc22f599475dbe881229aeddba6c79c2e9df35a2b3</hash>
+            <hash alg="SHA-256">5d97e9ae94fb96df1ee3cb09ca376c34e8a122f36927230f4c8a97f469994bff</hash>
+            <hash alg="SHA-256">5feae2f9aa7270e2c071f488fab256d768e88e01b958f123a690f1cc3061a09c</hash>
+            <hash alg="SHA-256">603d5868f7419081d616dab7ac3cfa285296735e7350f7b1e4f548f6f953ee7d</hash>
+            <hash alg="SHA-256">61d42d2b08430854485135504f672c14d4fc644dd243a9c17e7c4e0faf5ed07e</hash>
+            <hash alg="SHA-256">61dbc1e01dc0c5875da2f7ae36d6e918dc1b8d2ce04e871793976594aad8a57a</hash>
+            <hash alg="SHA-256">65cfed9c807c27dee76407e8bb29e6f4e391e436774bcc769a037ff25ad8646e</hash>
+            <hash alg="SHA-256">67a429520e97621a763cf9b3ba27574779c4e96e49a27ff8a1aa99ee70beb28a</hash>
+            <hash alg="SHA-256">6aadae3042f8e6db3376d9e91f194c606c9a45273c170621d46128f35aef7cd0</hash>
+            <hash alg="SHA-256">6ba8858933f0c1a979781272a5f65646fca8c18c93c99c6ddb5513ad96fa54b1</hash>
+            <hash alg="SHA-256">6bc568b05e02cd612be53900c88aaa55012e744930ba2eeb56279db4c6676eb3</hash>
+            <hash alg="SHA-256">729408136ef8d45a28ee9a7411917c9e3459cf266c7e23c2f7d4bb8ef9e0da42</hash>
+            <hash alg="SHA-256">751758d9dd04d548ec679224cc00e3591f5ebf1ff159ed0d4aba6a0746352452</hash>
+            <hash alg="SHA-256">76d59d4d451ba77f08cb4cd9268dec07be5bc65f73666302dbb5061989b17198</hash>
+            <hash alg="SHA-256">79bf58c08f0756adba691d480b5a20e4ad23f33e1ae121584cf3a21717c36dfa</hash>
+            <hash alg="SHA-256">7de12b69d95072394998c622cfd7e8cea8f560db5fca6a62a148f902a1029f8b</hash>
+            <hash alg="SHA-256">7f55cd9cf1564b7b03f238e4c017ca4794c05b01a783e9291065cb2858d86ce4</hash>
+            <hash alg="SHA-256">80e5acb81cb49fd9f2d5c08f8b74ffff14ee73b10ca88297ab4619e946bcb1e1</hash>
+            <hash alg="SHA-256">87a90f5545fd61f6964e65eebde4dc3fa8660bb7d87adb01d4cf17e0a2b484ad</hash>
+            <hash alg="SHA-256">881df98f0a8404d32b6de0fd33e91c1b90ed1516a80d4d6dc69d414b8850474c</hash>
+            <hash alg="SHA-256">8a776a29b77fe0cc28fedfd87277b0d0f7aa930174b7e504d764e0b43a05f381</hash>
+            <hash alg="SHA-256">8c2a61c0e4811012b0ba9f6cdcb4437865df5d29eab5d6018ba13cee1c3064a0</hash>
+            <hash alg="SHA-256">8fa6bd071ec6d90f6e7baa66ae25820d57a8ab1b0a3c6d3edf1834d4b26fafa2</hash>
+            <hash alg="SHA-256">96f2975fb14f39c5fe75203f33dd3010fe37d1c4e33177feef1107b5ced750e3</hash>
+            <hash alg="SHA-256">96fb0899bb2ab353f42e5374c8f0789f54e0a94ef2f02b9ac7149c56622eaf31</hash>
+            <hash alg="SHA-256">97163a1ab265a1073a6372eca9f4eeb9f8c6327457a0b22ddfc4a17dcd613e74</hash>
+            <hash alg="SHA-256">9c95a1a290f9acf7a8f2ebbdd183e99215d491beea52d61aa2a7a7d2c618ddc6</hash>
+            <hash alg="SHA-256">9d94d78418203904730585efa71002286ac4c8ac0689d0eb61e3c465f9e608ff</hash>
+            <hash alg="SHA-256">a6ba2cb7d676e9415b9e9ac7e2aae401dc1b1e666943d1f7bc66223d3d73467b</hash>
+            <hash alg="SHA-256">aa0379c1935c44053c98826bc99ac95f3a5355675a297ac9ce0dfad0ce2d50ca</hash>
+            <hash alg="SHA-256">ac96d67b37f28e4b6ecf507c3405f52a40658c0a806dffde624a8fcb0314d5fd</hash>
+            <hash alg="SHA-256">ade2ccb937060c299ab0dfb2dea3d2ddf7e098ed63ee3d651ebfc2c8d1e8632a</hash>
+            <hash alg="SHA-256">aefbdc934115d2f9278f153952003ac52cd2650e7313750390b334518c589568</hash>
+            <hash alg="SHA-256">b07501b720cf060c5856f7b5626e75b8e353b5f98b9b354a21eb4bfa47e421b1</hash>
+            <hash alg="SHA-256">b5267feb19070bef34b8dea27e2b504ebd9d31748e3ecacb3a4101da6fcb255c</hash>
+            <hash alg="SHA-256">b5f6328e8e2ae8238fc767703ab7b95785521c42bb2b8790984e3477d7fa71ad</hash>
+            <hash alg="SHA-256">b8996ffb60c69f677245f5abdbcc623e9442bcc91ed81b6cd6187129ad1fa3e7</hash>
+            <hash alg="SHA-256">b981a370f8f41c4024c170b42fbe9e691ae2dbc19d1d99151a69e2c84a0d194d</hash>
+            <hash alg="SHA-256">b9d121be0217787a7d59a5c6195b0842d3f701007333426e5154bf72346aa658</hash>
+            <hash alg="SHA-256">bcef4f2d3dc603150421de85c916da19471f24d838c3c62a4f04c1eb511642c1</hash>
+            <hash alg="SHA-256">bed0252c85e21cf73d2d033643c945b460d6a02fc4a7d644e3b2d6f5f2956c64</hash>
+            <hash alg="SHA-256">bfdfbe6a36bc3059fff845d64c42f2644cf875c65f5005db54f90cdfdf1df815</hash>
+            <hash alg="SHA-256">c0095b8aa3e432e32d372e9a7737e65b58d5ed23b9620fea7cb81f17672f1fa1</hash>
+            <hash alg="SHA-256">c1f41d32a2ddc5a94df4b829b395916a4b7f103350fa76ba6de625fcb9e773ac</hash>
+            <hash alg="SHA-256">c45008ca79bad237cbc03c72bc5205e8c6f66403773929b1b50f7d84ef9e4d07</hash>
+            <hash alg="SHA-256">c82bbf7e03748417c3a88c1b0b291288ce3e4887a795a3addaa7a1cfd9e7153e</hash>
+            <hash alg="SHA-256">c918621ee0a3d1fe61c313f2489464f2ae3d13633e60f520a8002a5e910982ee</hash>
+            <hash alg="SHA-256">d204957169f0b3511fb95395a9da7d4490fb361763a9f8b32b345a7fe119cb45</hash>
+            <hash alg="SHA-256">d329896c40d9e1e5c7715c98529e4a188a1f2df51212fd65102b32465612b5dc</hash>
+            <hash alg="SHA-256">d3a61e928feddc458a55110f42f626a2a20bea942ccedb6fb4cee70b4830ed41</hash>
+            <hash alg="SHA-256">d48db29bd47814671afdd76c7652aefacc25cf96aad6daefa82d738ee87461e2</hash>
+            <hash alg="SHA-256">d5593855b5b2b73dd8413c3fdfa5d95b99d657658f947ba2c4318591e745d083</hash>
+            <hash alg="SHA-256">d79c159adea0f1f4617f54aa156568ac69968f9ef4d1e5fefffc0a180830308e</hash>
+            <hash alg="SHA-256">db09b98c7540df69d4b47218da3fbd7cb466db0fb932e971c321f1c76f155266</hash>
+            <hash alg="SHA-256">ddf23960cb42b69bce13045d5bc66f18c7d53774c66c13f24cf1b9c144ba3141</hash>
+            <hash alg="SHA-256">e06cfea0ece444571d24c18ed465bc93afb8c8d8d74422eb7026662f3d3f779b</hash>
+            <hash alg="SHA-256">e7c564c58cf8f248fe859a4f0fe501b050663f3d7fbc342172f259124fb59933</hash>
+            <hash alg="SHA-256">e86593bf8637659e6a6ed58854b6c87ec4e9e45ee8a4adfd936831cef55c2d21</hash>
+            <hash alg="SHA-256">eaffbd8814bb1b5dc3ea156a4c5928081ba50419f9175f4fc95269e040eff8f0</hash>
+            <hash alg="SHA-256">ee353bb51f648924926ed05e0122b6a0b1ae709396a80eb583449d5d477fcdf7</hash>
+            <hash alg="SHA-256">ee6faebb265e28920a6f23a7d4c362414b3f4bb30607141d718b991669e49ddc</hash>
+            <hash alg="SHA-256">efe093acc43e869348f6f2224df7f452eab63a2c60a6c6cd6b50fd35c4e075ba</hash>
+            <hash alg="SHA-256">f03a1b3a4c03e3e0161642ac5367f08479ab29972ea0ffcd4fa18f729cd2be0a</hash>
+            <hash alg="SHA-256">f0d320e70b6b2300ff6029e234e79fe44e9dbbfc7b98597ba28e054bd6606a57</hash>
+            <hash alg="SHA-256">f252dfb4852a527987a9156cbcae3022a30f86c9d26f4f17b8c967d7580d65d2</hash>
+            <hash alg="SHA-256">f5f4424cb87a20b016bfdc157ff48757b89d2cc426256961643d443c6c277007</hash>
+            <hash alg="SHA-256">f8eae66a1304de7368932b42d801c67969fd090ddb1a7a24f27b435ed4bed68f</hash>
+            <hash alg="SHA-256">fdb82eb60d31b0c033a8e8ee9f3fc7dfbaa042211131c29da29aea8531b4f18f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="attrs==23.1.0"/>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==5.1.1"/>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2"/>
+    <dependency ref="jsonschema==4.20.0"/>
+    <dependency ref="license-expression==30.2.0"/>
+    <dependency ref="lxml==4.9.3"/>
+    <dependency ref="packageurl-python==0.11.2"/>
+    <dependency ref="py-serializable==0.15.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="referencing==0.31.1"/>
+    <dependency ref="rfc3339-validator==0.1.4"/>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.13.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.4.json.bin b/tests/_data/snapshots/pipenv/with-extras_1.4.json.bin
new file mode 100644
index 00000000..d32b1710
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.4.json.bin
@@ -0,0 +1,1615 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/"
+        }
+      ],
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean.py/"
+        }
+      ],
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==5.1.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/"
+        }
+      ],
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/"
+        }
+      ],
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/"
+        }
+      ],
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f614fd46d8d61258610998997743ec5492a648b33cf478c1ddc23ed4598a5fa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ed6231f0429ecf966f5bc8dfef245998220549cbbcf140f913b7464c52c3b6b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/"
+        }
+      ],
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9472fc4fea474cd74bea4a2b190daeccb5a9e4db2ea80efcf7a1b582fc9a81b8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e74ba7c0a65e8cb49dc26837d6cfe576557084a8b423ed16a420984228104f93"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1a7dc2bb2d09cdc983d072e4f9adc787e107e09def84cbb3919baaaf4f8e6fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "599928edd995c43fc335e0af342076144dc71cb858afa1ed9c1c30c4e81794f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/"
+        }
+      ],
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.3",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/"
+        }
+      ],
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python==0.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable==0.15.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/"
+        }
+      ],
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.31.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81a1471c68c9d5e3831c30ad1dd9815c45b558e596653db751a2bfdd17b3b9ec"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c19c4d006f1757e3dd75c4f784d38f8698d87b649c54f9ace14e5e8c9667c01d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/"
+        }
+      ],
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.31.1",
+      "type": "library",
+      "version": "0.31.1"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/"
+        }
+      ],
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.13.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06d218e4464d31301e943b65b2c6919318ea6f69703a351961e1baaf60347276"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "12ecf89bd54734c3c2c79898ae2021dca42750c7bcfb67f8fb3315453738ac8f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "15253fff410873ebf3cfba1cc686a37711efcd9b8cb30ea21bb14a973e393f60"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "188435794405c7f0573311747c85a96b63c954a5f2111b1df8018979eca0f2f0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1ceebd0ae4f3e9b2b6b553b51971921853ae4eebf3f54086be0565d59291e53d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "244e173bb6d8f3b2f0c4d7370a1aa341f35da3e57ffd1798e5b2917b91731fd3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25b28b3d33ec0a78e944aaaed7e5e2a94ac811bcd68b557ca48a0c30f87497d2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25ea41635d22b2eb6326f58e608550e55d01df51b8a580ea7e75396bafbb28e9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "29d311e44dd16d2434d5506d57ef4d7036544fc3c25c14b6992ef41f541b10fb"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2a1472956c5bcc49fb0252b965239bffe801acc9394f8b7c1014ae9258e4572b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2a7bef6977043673750a88da064fd513f89505111014b4e00fbdd13329cd4e9a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2ac26f50736324beb0282c819668328d53fc38543fa61eeea2c32ea8ea6eab8d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2e72f750048b32d39e87fc85c225c50b2a6715034848dbb196bf3348aa761fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "31e220a040b89a01505128c2f8a59ee74732f666439a03e65ccbf3824cdddae7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "35f53c76a712e323c779ca39b9a81b13f219a8e3bc15f106ed1e1462d56fcfe9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "38d4f822ee2f338febcc85aaa2547eb5ba31ba6ff68d10b8ec988929d23bb6b4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "38f9bf2ad754b4a45b8210a6c732fe876b8a14e14d5992a8c4b7c1ef78740f53"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3a44c8440183b43167fd1a0819e8356692bf5db1ad14ce140dbd40a1485f2dea"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3ab96754d23372009638a402a1ed12a27711598dd49d8316a22597141962fe66"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3c55d7f2d817183d43220738270efd3ce4e7a7b7cbdaefa6d551ed3d6ed89190"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "46e1ed994a0920f350a4547a38471217eb86f57377e9314fbaaa329b71b7dfe3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4a5375c5fff13f209527cd886dc75394f040c7d1ecad0a2cb0627f13ebe78a12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c2d26aa03d877c9730bf005621c92da263523a1e99247590abbbe252ccb7824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c4e314d36d4f31236a545696a480aa04ea170a0b021e9a59ab1ed94d4c3ef27"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d0c10d803549427f427085ed7aebc39832f6e818a011dcd8785e9c6a1ba9b3e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4dcc5ee1d0275cb78d443fdebd0241e58772a354a6d518b1d7af1580bbd2c4e8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "51967a67ea0d7b9b5cd86036878e2d82c0b6183616961c26d825b8c994d4f2c8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "530190eb0cd778363bbb7596612ded0bb9fef662daa98e9d92a0419ab27ae914"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5379e49d7e80dca9811b36894493d1c1ecb4c57de05c36f5d0dd09982af20211"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5493569f861fb7b05af6d048d00d773c6162415ae521b7010197c98810a14cab"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5a4c1058cdae6237d97af272b326e5f78ee7ee3bbffa6b24b09db4d828810468"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5d75d6d220d55cdced2f32cc22f599475dbe881229aeddba6c79c2e9df35a2b3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5d97e9ae94fb96df1ee3cb09ca376c34e8a122f36927230f4c8a97f469994bff"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5feae2f9aa7270e2c071f488fab256d768e88e01b958f123a690f1cc3061a09c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "603d5868f7419081d616dab7ac3cfa285296735e7350f7b1e4f548f6f953ee7d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "61d42d2b08430854485135504f672c14d4fc644dd243a9c17e7c4e0faf5ed07e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "61dbc1e01dc0c5875da2f7ae36d6e918dc1b8d2ce04e871793976594aad8a57a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65cfed9c807c27dee76407e8bb29e6f4e391e436774bcc769a037ff25ad8646e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "67a429520e97621a763cf9b3ba27574779c4e96e49a27ff8a1aa99ee70beb28a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6aadae3042f8e6db3376d9e91f194c606c9a45273c170621d46128f35aef7cd0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ba8858933f0c1a979781272a5f65646fca8c18c93c99c6ddb5513ad96fa54b1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6bc568b05e02cd612be53900c88aaa55012e744930ba2eeb56279db4c6676eb3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "729408136ef8d45a28ee9a7411917c9e3459cf266c7e23c2f7d4bb8ef9e0da42"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "751758d9dd04d548ec679224cc00e3591f5ebf1ff159ed0d4aba6a0746352452"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "76d59d4d451ba77f08cb4cd9268dec07be5bc65f73666302dbb5061989b17198"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "79bf58c08f0756adba691d480b5a20e4ad23f33e1ae121584cf3a21717c36dfa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7de12b69d95072394998c622cfd7e8cea8f560db5fca6a62a148f902a1029f8b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7f55cd9cf1564b7b03f238e4c017ca4794c05b01a783e9291065cb2858d86ce4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "80e5acb81cb49fd9f2d5c08f8b74ffff14ee73b10ca88297ab4619e946bcb1e1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "87a90f5545fd61f6964e65eebde4dc3fa8660bb7d87adb01d4cf17e0a2b484ad"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "881df98f0a8404d32b6de0fd33e91c1b90ed1516a80d4d6dc69d414b8850474c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8a776a29b77fe0cc28fedfd87277b0d0f7aa930174b7e504d764e0b43a05f381"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8c2a61c0e4811012b0ba9f6cdcb4437865df5d29eab5d6018ba13cee1c3064a0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8fa6bd071ec6d90f6e7baa66ae25820d57a8ab1b0a3c6d3edf1834d4b26fafa2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96f2975fb14f39c5fe75203f33dd3010fe37d1c4e33177feef1107b5ced750e3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96fb0899bb2ab353f42e5374c8f0789f54e0a94ef2f02b9ac7149c56622eaf31"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "97163a1ab265a1073a6372eca9f4eeb9f8c6327457a0b22ddfc4a17dcd613e74"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9c95a1a290f9acf7a8f2ebbdd183e99215d491beea52d61aa2a7a7d2c618ddc6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9d94d78418203904730585efa71002286ac4c8ac0689d0eb61e3c465f9e608ff"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a6ba2cb7d676e9415b9e9ac7e2aae401dc1b1e666943d1f7bc66223d3d73467b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aa0379c1935c44053c98826bc99ac95f3a5355675a297ac9ce0dfad0ce2d50ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ac96d67b37f28e4b6ecf507c3405f52a40658c0a806dffde624a8fcb0314d5fd"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ade2ccb937060c299ab0dfb2dea3d2ddf7e098ed63ee3d651ebfc2c8d1e8632a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aefbdc934115d2f9278f153952003ac52cd2650e7313750390b334518c589568"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b07501b720cf060c5856f7b5626e75b8e353b5f98b9b354a21eb4bfa47e421b1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b5267feb19070bef34b8dea27e2b504ebd9d31748e3ecacb3a4101da6fcb255c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b5f6328e8e2ae8238fc767703ab7b95785521c42bb2b8790984e3477d7fa71ad"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b8996ffb60c69f677245f5abdbcc623e9442bcc91ed81b6cd6187129ad1fa3e7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b981a370f8f41c4024c170b42fbe9e691ae2dbc19d1d99151a69e2c84a0d194d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b9d121be0217787a7d59a5c6195b0842d3f701007333426e5154bf72346aa658"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bcef4f2d3dc603150421de85c916da19471f24d838c3c62a4f04c1eb511642c1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bed0252c85e21cf73d2d033643c945b460d6a02fc4a7d644e3b2d6f5f2956c64"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bfdfbe6a36bc3059fff845d64c42f2644cf875c65f5005db54f90cdfdf1df815"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c0095b8aa3e432e32d372e9a7737e65b58d5ed23b9620fea7cb81f17672f1fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c1f41d32a2ddc5a94df4b829b395916a4b7f103350fa76ba6de625fcb9e773ac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c45008ca79bad237cbc03c72bc5205e8c6f66403773929b1b50f7d84ef9e4d07"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c82bbf7e03748417c3a88c1b0b291288ce3e4887a795a3addaa7a1cfd9e7153e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c918621ee0a3d1fe61c313f2489464f2ae3d13633e60f520a8002a5e910982ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d204957169f0b3511fb95395a9da7d4490fb361763a9f8b32b345a7fe119cb45"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d329896c40d9e1e5c7715c98529e4a188a1f2df51212fd65102b32465612b5dc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3a61e928feddc458a55110f42f626a2a20bea942ccedb6fb4cee70b4830ed41"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d48db29bd47814671afdd76c7652aefacc25cf96aad6daefa82d738ee87461e2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d5593855b5b2b73dd8413c3fdfa5d95b99d657658f947ba2c4318591e745d083"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d79c159adea0f1f4617f54aa156568ac69968f9ef4d1e5fefffc0a180830308e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "db09b98c7540df69d4b47218da3fbd7cb466db0fb932e971c321f1c76f155266"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ddf23960cb42b69bce13045d5bc66f18c7d53774c66c13f24cf1b9c144ba3141"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e06cfea0ece444571d24c18ed465bc93afb8c8d8d74422eb7026662f3d3f779b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e7c564c58cf8f248fe859a4f0fe501b050663f3d7fbc342172f259124fb59933"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e86593bf8637659e6a6ed58854b6c87ec4e9e45ee8a4adfd936831cef55c2d21"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eaffbd8814bb1b5dc3ea156a4c5928081ba50419f9175f4fc95269e040eff8f0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ee353bb51f648924926ed05e0122b6a0b1ae709396a80eb583449d5d477fcdf7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ee6faebb265e28920a6f23a7d4c362414b3f4bb30607141d718b991669e49ddc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "efe093acc43e869348f6f2224df7f452eab63a2c60a6c6cd6b50fd35c4e075ba"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f03a1b3a4c03e3e0161642ac5367f08479ab29972ea0ffcd4fa18f729cd2be0a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f0d320e70b6b2300ff6029e234e79fe44e9dbbfc7b98597ba28e054bd6606a57"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f252dfb4852a527987a9156cbcae3022a30f86c9d26f4f17b8c967d7580d65d2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f5f4424cb87a20b016bfdc157ff48757b89d2cc426256961643d443c6c277007"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f8eae66a1304de7368932b42d801c67969fd090ddb1a7a24f27b435ed4bed68f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fdb82eb60d31b0c033a8e8ee9f3fc7dfbaa042211131c29da29aea8531b4f18f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/"
+        }
+      ],
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.13.2",
+      "type": "library",
+      "version": "0.13.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/"
+        }
+      ],
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/"
+        }
+      ],
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/"
+        }
+      ],
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib==5.1.1"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.3"
+    },
+    {
+      "ref": "packageurl-python==0.11.2"
+    },
+    {
+      "ref": "py-serializable==0.15.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "referencing==0.31.1"
+    },
+    {
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.13.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.4.xml.bin b/tests/_data/snapshots/pipenv/with-extras_1.4.xml.bin
new file mode 100644
index 00000000..5265faed
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.4.xml.bin
@@ -0,0 +1,719 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean.py/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca</hash>
+            <hash alg="SHA-256">c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">4f614fd46d8d61258610998997743ec5492a648b33cf478c1ddc23ed4598a5fa</hash>
+            <hash alg="SHA-256">ed6231f0429ecf966f5bc8dfef245998220549cbbcf140f913b7464c52c3b6b3</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+        <property name="cdx:python:package:extra">format</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9472fc4fea474cd74bea4a2b190daeccb5a9e4db2ea80efcf7a1b582fc9a81b8</hash>
+            <hash alg="SHA-256">e74ba7c0a65e8cb49dc26837d6cfe576557084a8b423ed16a420984228104f93</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1a7dc2bb2d09cdc983d072e4f9adc787e107e09def84cbb3919baaaf4f8e6fa1</hash>
+            <hash alg="SHA-256">599928edd995c43fc335e0af342076144dc71cb858afa1ed9c1c30c4e81794f5</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing==0.31.1">
+      <name>referencing</name>
+      <version>0.31.1</version>
+      <purl>pkg:pypi/referencing@0.31.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">81a1471c68c9d5e3831c30ad1dd9815c45b558e596653db751a2bfdd17b3b9ec</hash>
+            <hash alg="SHA-256">c19c4d006f1757e3dd75c4f784d38f8698d87b649c54f9ace14e5e8c9667c01d</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.13.2">
+      <name>rpds-py</name>
+      <version>0.13.2</version>
+      <purl>pkg:pypi/rpds-py@0.13.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">06d218e4464d31301e943b65b2c6919318ea6f69703a351961e1baaf60347276</hash>
+            <hash alg="SHA-256">12ecf89bd54734c3c2c79898ae2021dca42750c7bcfb67f8fb3315453738ac8f</hash>
+            <hash alg="SHA-256">15253fff410873ebf3cfba1cc686a37711efcd9b8cb30ea21bb14a973e393f60</hash>
+            <hash alg="SHA-256">188435794405c7f0573311747c85a96b63c954a5f2111b1df8018979eca0f2f0</hash>
+            <hash alg="SHA-256">1ceebd0ae4f3e9b2b6b553b51971921853ae4eebf3f54086be0565d59291e53d</hash>
+            <hash alg="SHA-256">244e173bb6d8f3b2f0c4d7370a1aa341f35da3e57ffd1798e5b2917b91731fd3</hash>
+            <hash alg="SHA-256">25b28b3d33ec0a78e944aaaed7e5e2a94ac811bcd68b557ca48a0c30f87497d2</hash>
+            <hash alg="SHA-256">25ea41635d22b2eb6326f58e608550e55d01df51b8a580ea7e75396bafbb28e9</hash>
+            <hash alg="SHA-256">29d311e44dd16d2434d5506d57ef4d7036544fc3c25c14b6992ef41f541b10fb</hash>
+            <hash alg="SHA-256">2a1472956c5bcc49fb0252b965239bffe801acc9394f8b7c1014ae9258e4572b</hash>
+            <hash alg="SHA-256">2a7bef6977043673750a88da064fd513f89505111014b4e00fbdd13329cd4e9a</hash>
+            <hash alg="SHA-256">2ac26f50736324beb0282c819668328d53fc38543fa61eeea2c32ea8ea6eab8d</hash>
+            <hash alg="SHA-256">2e72f750048b32d39e87fc85c225c50b2a6715034848dbb196bf3348aa761fa1</hash>
+            <hash alg="SHA-256">31e220a040b89a01505128c2f8a59ee74732f666439a03e65ccbf3824cdddae7</hash>
+            <hash alg="SHA-256">35f53c76a712e323c779ca39b9a81b13f219a8e3bc15f106ed1e1462d56fcfe9</hash>
+            <hash alg="SHA-256">38d4f822ee2f338febcc85aaa2547eb5ba31ba6ff68d10b8ec988929d23bb6b4</hash>
+            <hash alg="SHA-256">38f9bf2ad754b4a45b8210a6c732fe876b8a14e14d5992a8c4b7c1ef78740f53</hash>
+            <hash alg="SHA-256">3a44c8440183b43167fd1a0819e8356692bf5db1ad14ce140dbd40a1485f2dea</hash>
+            <hash alg="SHA-256">3ab96754d23372009638a402a1ed12a27711598dd49d8316a22597141962fe66</hash>
+            <hash alg="SHA-256">3c55d7f2d817183d43220738270efd3ce4e7a7b7cbdaefa6d551ed3d6ed89190</hash>
+            <hash alg="SHA-256">46e1ed994a0920f350a4547a38471217eb86f57377e9314fbaaa329b71b7dfe3</hash>
+            <hash alg="SHA-256">4a5375c5fff13f209527cd886dc75394f040c7d1ecad0a2cb0627f13ebe78a12</hash>
+            <hash alg="SHA-256">4c2d26aa03d877c9730bf005621c92da263523a1e99247590abbbe252ccb7824</hash>
+            <hash alg="SHA-256">4c4e314d36d4f31236a545696a480aa04ea170a0b021e9a59ab1ed94d4c3ef27</hash>
+            <hash alg="SHA-256">4d0c10d803549427f427085ed7aebc39832f6e818a011dcd8785e9c6a1ba9b3e</hash>
+            <hash alg="SHA-256">4dcc5ee1d0275cb78d443fdebd0241e58772a354a6d518b1d7af1580bbd2c4e8</hash>
+            <hash alg="SHA-256">51967a67ea0d7b9b5cd86036878e2d82c0b6183616961c26d825b8c994d4f2c8</hash>
+            <hash alg="SHA-256">530190eb0cd778363bbb7596612ded0bb9fef662daa98e9d92a0419ab27ae914</hash>
+            <hash alg="SHA-256">5379e49d7e80dca9811b36894493d1c1ecb4c57de05c36f5d0dd09982af20211</hash>
+            <hash alg="SHA-256">5493569f861fb7b05af6d048d00d773c6162415ae521b7010197c98810a14cab</hash>
+            <hash alg="SHA-256">5a4c1058cdae6237d97af272b326e5f78ee7ee3bbffa6b24b09db4d828810468</hash>
+            <hash alg="SHA-256">5d75d6d220d55cdced2f32cc22f599475dbe881229aeddba6c79c2e9df35a2b3</hash>
+            <hash alg="SHA-256">5d97e9ae94fb96df1ee3cb09ca376c34e8a122f36927230f4c8a97f469994bff</hash>
+            <hash alg="SHA-256">5feae2f9aa7270e2c071f488fab256d768e88e01b958f123a690f1cc3061a09c</hash>
+            <hash alg="SHA-256">603d5868f7419081d616dab7ac3cfa285296735e7350f7b1e4f548f6f953ee7d</hash>
+            <hash alg="SHA-256">61d42d2b08430854485135504f672c14d4fc644dd243a9c17e7c4e0faf5ed07e</hash>
+            <hash alg="SHA-256">61dbc1e01dc0c5875da2f7ae36d6e918dc1b8d2ce04e871793976594aad8a57a</hash>
+            <hash alg="SHA-256">65cfed9c807c27dee76407e8bb29e6f4e391e436774bcc769a037ff25ad8646e</hash>
+            <hash alg="SHA-256">67a429520e97621a763cf9b3ba27574779c4e96e49a27ff8a1aa99ee70beb28a</hash>
+            <hash alg="SHA-256">6aadae3042f8e6db3376d9e91f194c606c9a45273c170621d46128f35aef7cd0</hash>
+            <hash alg="SHA-256">6ba8858933f0c1a979781272a5f65646fca8c18c93c99c6ddb5513ad96fa54b1</hash>
+            <hash alg="SHA-256">6bc568b05e02cd612be53900c88aaa55012e744930ba2eeb56279db4c6676eb3</hash>
+            <hash alg="SHA-256">729408136ef8d45a28ee9a7411917c9e3459cf266c7e23c2f7d4bb8ef9e0da42</hash>
+            <hash alg="SHA-256">751758d9dd04d548ec679224cc00e3591f5ebf1ff159ed0d4aba6a0746352452</hash>
+            <hash alg="SHA-256">76d59d4d451ba77f08cb4cd9268dec07be5bc65f73666302dbb5061989b17198</hash>
+            <hash alg="SHA-256">79bf58c08f0756adba691d480b5a20e4ad23f33e1ae121584cf3a21717c36dfa</hash>
+            <hash alg="SHA-256">7de12b69d95072394998c622cfd7e8cea8f560db5fca6a62a148f902a1029f8b</hash>
+            <hash alg="SHA-256">7f55cd9cf1564b7b03f238e4c017ca4794c05b01a783e9291065cb2858d86ce4</hash>
+            <hash alg="SHA-256">80e5acb81cb49fd9f2d5c08f8b74ffff14ee73b10ca88297ab4619e946bcb1e1</hash>
+            <hash alg="SHA-256">87a90f5545fd61f6964e65eebde4dc3fa8660bb7d87adb01d4cf17e0a2b484ad</hash>
+            <hash alg="SHA-256">881df98f0a8404d32b6de0fd33e91c1b90ed1516a80d4d6dc69d414b8850474c</hash>
+            <hash alg="SHA-256">8a776a29b77fe0cc28fedfd87277b0d0f7aa930174b7e504d764e0b43a05f381</hash>
+            <hash alg="SHA-256">8c2a61c0e4811012b0ba9f6cdcb4437865df5d29eab5d6018ba13cee1c3064a0</hash>
+            <hash alg="SHA-256">8fa6bd071ec6d90f6e7baa66ae25820d57a8ab1b0a3c6d3edf1834d4b26fafa2</hash>
+            <hash alg="SHA-256">96f2975fb14f39c5fe75203f33dd3010fe37d1c4e33177feef1107b5ced750e3</hash>
+            <hash alg="SHA-256">96fb0899bb2ab353f42e5374c8f0789f54e0a94ef2f02b9ac7149c56622eaf31</hash>
+            <hash alg="SHA-256">97163a1ab265a1073a6372eca9f4eeb9f8c6327457a0b22ddfc4a17dcd613e74</hash>
+            <hash alg="SHA-256">9c95a1a290f9acf7a8f2ebbdd183e99215d491beea52d61aa2a7a7d2c618ddc6</hash>
+            <hash alg="SHA-256">9d94d78418203904730585efa71002286ac4c8ac0689d0eb61e3c465f9e608ff</hash>
+            <hash alg="SHA-256">a6ba2cb7d676e9415b9e9ac7e2aae401dc1b1e666943d1f7bc66223d3d73467b</hash>
+            <hash alg="SHA-256">aa0379c1935c44053c98826bc99ac95f3a5355675a297ac9ce0dfad0ce2d50ca</hash>
+            <hash alg="SHA-256">ac96d67b37f28e4b6ecf507c3405f52a40658c0a806dffde624a8fcb0314d5fd</hash>
+            <hash alg="SHA-256">ade2ccb937060c299ab0dfb2dea3d2ddf7e098ed63ee3d651ebfc2c8d1e8632a</hash>
+            <hash alg="SHA-256">aefbdc934115d2f9278f153952003ac52cd2650e7313750390b334518c589568</hash>
+            <hash alg="SHA-256">b07501b720cf060c5856f7b5626e75b8e353b5f98b9b354a21eb4bfa47e421b1</hash>
+            <hash alg="SHA-256">b5267feb19070bef34b8dea27e2b504ebd9d31748e3ecacb3a4101da6fcb255c</hash>
+            <hash alg="SHA-256">b5f6328e8e2ae8238fc767703ab7b95785521c42bb2b8790984e3477d7fa71ad</hash>
+            <hash alg="SHA-256">b8996ffb60c69f677245f5abdbcc623e9442bcc91ed81b6cd6187129ad1fa3e7</hash>
+            <hash alg="SHA-256">b981a370f8f41c4024c170b42fbe9e691ae2dbc19d1d99151a69e2c84a0d194d</hash>
+            <hash alg="SHA-256">b9d121be0217787a7d59a5c6195b0842d3f701007333426e5154bf72346aa658</hash>
+            <hash alg="SHA-256">bcef4f2d3dc603150421de85c916da19471f24d838c3c62a4f04c1eb511642c1</hash>
+            <hash alg="SHA-256">bed0252c85e21cf73d2d033643c945b460d6a02fc4a7d644e3b2d6f5f2956c64</hash>
+            <hash alg="SHA-256">bfdfbe6a36bc3059fff845d64c42f2644cf875c65f5005db54f90cdfdf1df815</hash>
+            <hash alg="SHA-256">c0095b8aa3e432e32d372e9a7737e65b58d5ed23b9620fea7cb81f17672f1fa1</hash>
+            <hash alg="SHA-256">c1f41d32a2ddc5a94df4b829b395916a4b7f103350fa76ba6de625fcb9e773ac</hash>
+            <hash alg="SHA-256">c45008ca79bad237cbc03c72bc5205e8c6f66403773929b1b50f7d84ef9e4d07</hash>
+            <hash alg="SHA-256">c82bbf7e03748417c3a88c1b0b291288ce3e4887a795a3addaa7a1cfd9e7153e</hash>
+            <hash alg="SHA-256">c918621ee0a3d1fe61c313f2489464f2ae3d13633e60f520a8002a5e910982ee</hash>
+            <hash alg="SHA-256">d204957169f0b3511fb95395a9da7d4490fb361763a9f8b32b345a7fe119cb45</hash>
+            <hash alg="SHA-256">d329896c40d9e1e5c7715c98529e4a188a1f2df51212fd65102b32465612b5dc</hash>
+            <hash alg="SHA-256">d3a61e928feddc458a55110f42f626a2a20bea942ccedb6fb4cee70b4830ed41</hash>
+            <hash alg="SHA-256">d48db29bd47814671afdd76c7652aefacc25cf96aad6daefa82d738ee87461e2</hash>
+            <hash alg="SHA-256">d5593855b5b2b73dd8413c3fdfa5d95b99d657658f947ba2c4318591e745d083</hash>
+            <hash alg="SHA-256">d79c159adea0f1f4617f54aa156568ac69968f9ef4d1e5fefffc0a180830308e</hash>
+            <hash alg="SHA-256">db09b98c7540df69d4b47218da3fbd7cb466db0fb932e971c321f1c76f155266</hash>
+            <hash alg="SHA-256">ddf23960cb42b69bce13045d5bc66f18c7d53774c66c13f24cf1b9c144ba3141</hash>
+            <hash alg="SHA-256">e06cfea0ece444571d24c18ed465bc93afb8c8d8d74422eb7026662f3d3f779b</hash>
+            <hash alg="SHA-256">e7c564c58cf8f248fe859a4f0fe501b050663f3d7fbc342172f259124fb59933</hash>
+            <hash alg="SHA-256">e86593bf8637659e6a6ed58854b6c87ec4e9e45ee8a4adfd936831cef55c2d21</hash>
+            <hash alg="SHA-256">eaffbd8814bb1b5dc3ea156a4c5928081ba50419f9175f4fc95269e040eff8f0</hash>
+            <hash alg="SHA-256">ee353bb51f648924926ed05e0122b6a0b1ae709396a80eb583449d5d477fcdf7</hash>
+            <hash alg="SHA-256">ee6faebb265e28920a6f23a7d4c362414b3f4bb30607141d718b991669e49ddc</hash>
+            <hash alg="SHA-256">efe093acc43e869348f6f2224df7f452eab63a2c60a6c6cd6b50fd35c4e075ba</hash>
+            <hash alg="SHA-256">f03a1b3a4c03e3e0161642ac5367f08479ab29972ea0ffcd4fa18f729cd2be0a</hash>
+            <hash alg="SHA-256">f0d320e70b6b2300ff6029e234e79fe44e9dbbfc7b98597ba28e054bd6606a57</hash>
+            <hash alg="SHA-256">f252dfb4852a527987a9156cbcae3022a30f86c9d26f4f17b8c967d7580d65d2</hash>
+            <hash alg="SHA-256">f5f4424cb87a20b016bfdc157ff48757b89d2cc426256961643d443c6c277007</hash>
+            <hash alg="SHA-256">f8eae66a1304de7368932b42d801c67969fd090ddb1a7a24f27b435ed4bed68f</hash>
+            <hash alg="SHA-256">fdb82eb60d31b0c033a8e8ee9f3fc7dfbaa042211131c29da29aea8531b4f18f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="attrs==23.1.0"/>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==5.1.1"/>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2"/>
+    <dependency ref="jsonschema==4.20.0"/>
+    <dependency ref="license-expression==30.2.0"/>
+    <dependency ref="lxml==4.9.3"/>
+    <dependency ref="packageurl-python==0.11.2"/>
+    <dependency ref="py-serializable==0.15.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="referencing==0.31.1"/>
+    <dependency ref="rfc3339-validator==0.1.4"/>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.13.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.0.xml.bin b/tests/_data/snapshots/pipenv/with-urls_1.0.xml.bin
new file mode 100644
index 00000000..33d1f6e3
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.0.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>certifi</name>
+      <version>2023.11.17</version>
+      <purl>pkg:pypi/certifi@2023.11.17</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>charset-normalizer</name>
+      <version>3.3.2</version>
+      <purl>pkg:pypi/charset-normalizer@3.3.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>pillow</name>
+      <version/>
+      <purl>pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>requests</name>
+      <version/>
+      <purl>pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version/>
+      <purl>pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.1.xml.bin b/tests/_data/snapshots/pipenv/with-urls_1.1.xml.bin
new file mode 100644
index 00000000..ae22e7e2
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.1.xml.bin
@@ -0,0 +1,82 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="certifi==2023.11.17">
+      <name>certifi</name>
+      <version>2023.11.17</version>
+      <purl>pkg:pypi/certifi@2023.11.17</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="charset-normalizer==3.3.2">
+      <name>charset-normalizer</name>
+      <version>3.3.2</version>
+      <purl>pkg:pypi/charset-normalizer@3.3.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/charset-normalizer/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pillow">
+      <name>pillow</name>
+      <version/>
+      <purl>pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version/>
+      <purl>pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six">
+      <name>six</name>
+      <version/>
+      <purl>pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.2.json.bin b/tests/_data/snapshots/pipenv/with-urls_1.2.json.bin
new file mode 100644
index 00000000..4ebda7c8
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.2.json.bin
@@ -0,0 +1,153 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi==2023.11.17",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2023.11.17",
+      "type": "library",
+      "version": "2023.11.17"
+    },
+    {
+      "bom-ref": "charset-normalizer==3.3.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/charset-normalizer/"
+        }
+      ],
+      "name": "charset-normalizer",
+      "purl": "pkg:pypi/charset-normalizer@3.3.2",
+      "type": "library",
+      "version": "3.3.2"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "pillow",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "pillow",
+      "purl": "pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requests",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375"
+        }
+      ],
+      "name": "requests",
+      "purl": "pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "six",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "urllib3",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi==2023.11.17"
+    },
+    {
+      "ref": "charset-normalizer==3.3.2"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "pillow"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.2.xml.bin b/tests/_data/snapshots/pipenv/with-urls_1.2.xml.bin
new file mode 100644
index 00000000..b39ec028
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.2.xml.bin
@@ -0,0 +1,111 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi==2023.11.17">
+      <name>certifi</name>
+      <version>2023.11.17</version>
+      <purl>pkg:pypi/certifi@2023.11.17</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="charset-normalizer==3.3.2">
+      <name>charset-normalizer</name>
+      <version>3.3.2</version>
+      <purl>pkg:pypi/charset-normalizer@3.3.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/charset-normalizer/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pillow">
+      <name>pillow</name>
+      <version/>
+      <purl>pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version/>
+      <purl>pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six">
+      <name>six</name>
+      <version/>
+      <purl>pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi==2023.11.17"/>
+    <dependency ref="charset-normalizer==3.3.2"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="pillow"/>
+    <dependency ref="requests"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.3.json.bin b/tests/_data/snapshots/pipenv/with-urls_1.3.json.bin
new file mode 100644
index 00000000..e1a2918c
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.3.json.bin
@@ -0,0 +1,577 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi==2023.11.17",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b469f3a900bf28dc19b8cfbf8019bf47f7fdd1a65a1d4ffb98fc14166beb4d1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e036ab49d5b79556f99cfc2d9320b34cfbe5be05c5871b51de9329f0603b0474"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/certifi@2023.11.17",
+      "type": "library",
+      "version": "2023.11.17"
+    },
+    {
+      "bom-ref": "charset-normalizer==3.3.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2127566c664442652f024c837091890cb1942c30937add288223dc895793f898"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/charset-normalizer/"
+        }
+      ],
+      "name": "charset-normalizer",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/charset-normalizer@3.3.2",
+      "type": "library",
+      "version": "3.3.2"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "pillow",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "pillow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "requests",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375"
+        }
+      ],
+      "name": "requests",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "six",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
+      "type": "library",
+      "version": ""
+    },
+    {
+      "bom-ref": "urllib3",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": ""
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi==2023.11.17"
+    },
+    {
+      "ref": "charset-normalizer==3.3.2"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "pillow"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.3.xml.bin b/tests/_data/snapshots/pipenv/with-urls_1.3.xml.bin
new file mode 100644
index 00000000..6462bf2d
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.3.xml.bin
@@ -0,0 +1,232 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi==2023.11.17">
+      <name>certifi</name>
+      <version>2023.11.17</version>
+      <purl>pkg:pypi/certifi@2023.11.17</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9b469f3a900bf28dc19b8cfbf8019bf47f7fdd1a65a1d4ffb98fc14166beb4d1</hash>
+            <hash alg="SHA-256">e036ab49d5b79556f99cfc2d9320b34cfbe5be05c5871b51de9329f0603b0474</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="charset-normalizer==3.3.2">
+      <name>charset-normalizer</name>
+      <version>3.3.2</version>
+      <purl>pkg:pypi/charset-normalizer@3.3.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/charset-normalizer/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027</hash>
+            <hash alg="SHA-256">06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087</hash>
+            <hash alg="SHA-256">0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786</hash>
+            <hash alg="SHA-256">0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8</hash>
+            <hash alg="SHA-256">10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09</hash>
+            <hash alg="SHA-256">122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185</hash>
+            <hash alg="SHA-256">1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574</hash>
+            <hash alg="SHA-256">1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e</hash>
+            <hash alg="SHA-256">1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519</hash>
+            <hash alg="SHA-256">2127566c664442652f024c837091890cb1942c30937add288223dc895793f898</hash>
+            <hash alg="SHA-256">22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269</hash>
+            <hash alg="SHA-256">25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3</hash>
+            <hash alg="SHA-256">2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f</hash>
+            <hash alg="SHA-256">3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6</hash>
+            <hash alg="SHA-256">34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8</hash>
+            <hash alg="SHA-256">37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a</hash>
+            <hash alg="SHA-256">3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73</hash>
+            <hash alg="SHA-256">3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc</hash>
+            <hash alg="SHA-256">42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714</hash>
+            <hash alg="SHA-256">45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2</hash>
+            <hash alg="SHA-256">4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc</hash>
+            <hash alg="SHA-256">4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce</hash>
+            <hash alg="SHA-256">4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d</hash>
+            <hash alg="SHA-256">549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e</hash>
+            <hash alg="SHA-256">55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6</hash>
+            <hash alg="SHA-256">572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269</hash>
+            <hash alg="SHA-256">573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96</hash>
+            <hash alg="SHA-256">5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d</hash>
+            <hash alg="SHA-256">6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a</hash>
+            <hash alg="SHA-256">65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4</hash>
+            <hash alg="SHA-256">663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77</hash>
+            <hash alg="SHA-256">6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d</hash>
+            <hash alg="SHA-256">68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0</hash>
+            <hash alg="SHA-256">6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed</hash>
+            <hash alg="SHA-256">6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068</hash>
+            <hash alg="SHA-256">6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac</hash>
+            <hash alg="SHA-256">6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25</hash>
+            <hash alg="SHA-256">753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8</hash>
+            <hash alg="SHA-256">7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab</hash>
+            <hash alg="SHA-256">7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26</hash>
+            <hash alg="SHA-256">7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2</hash>
+            <hash alg="SHA-256">802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db</hash>
+            <hash alg="SHA-256">80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f</hash>
+            <hash alg="SHA-256">8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5</hash>
+            <hash alg="SHA-256">86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99</hash>
+            <hash alg="SHA-256">87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c</hash>
+            <hash alg="SHA-256">8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d</hash>
+            <hash alg="SHA-256">8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811</hash>
+            <hash alg="SHA-256">8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa</hash>
+            <hash alg="SHA-256">8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a</hash>
+            <hash alg="SHA-256">9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03</hash>
+            <hash alg="SHA-256">90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b</hash>
+            <hash alg="SHA-256">923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04</hash>
+            <hash alg="SHA-256">95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c</hash>
+            <hash alg="SHA-256">96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001</hash>
+            <hash alg="SHA-256">9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458</hash>
+            <hash alg="SHA-256">a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389</hash>
+            <hash alg="SHA-256">a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99</hash>
+            <hash alg="SHA-256">a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985</hash>
+            <hash alg="SHA-256">a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537</hash>
+            <hash alg="SHA-256">ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238</hash>
+            <hash alg="SHA-256">aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f</hash>
+            <hash alg="SHA-256">b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d</hash>
+            <hash alg="SHA-256">b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796</hash>
+            <hash alg="SHA-256">b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a</hash>
+            <hash alg="SHA-256">b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143</hash>
+            <hash alg="SHA-256">bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8</hash>
+            <hash alg="SHA-256">beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c</hash>
+            <hash alg="SHA-256">c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5</hash>
+            <hash alg="SHA-256">c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5</hash>
+            <hash alg="SHA-256">c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711</hash>
+            <hash alg="SHA-256">c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4</hash>
+            <hash alg="SHA-256">cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6</hash>
+            <hash alg="SHA-256">d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c</hash>
+            <hash alg="SHA-256">d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7</hash>
+            <hash alg="SHA-256">db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4</hash>
+            <hash alg="SHA-256">ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b</hash>
+            <hash alg="SHA-256">deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae</hash>
+            <hash alg="SHA-256">e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12</hash>
+            <hash alg="SHA-256">e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c</hash>
+            <hash alg="SHA-256">e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae</hash>
+            <hash alg="SHA-256">eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8</hash>
+            <hash alg="SHA-256">eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887</hash>
+            <hash alg="SHA-256">eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b</hash>
+            <hash alg="SHA-256">efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4</hash>
+            <hash alg="SHA-256">f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f</hash>
+            <hash alg="SHA-256">f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5</hash>
+            <hash alg="SHA-256">fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33</hash>
+            <hash alg="SHA-256">fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519</hash>
+            <hash alg="SHA-256">ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca</hash>
+            <hash alg="SHA-256">c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="pillow">
+      <name>pillow</name>
+      <version/>
+      <purl>pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <version/>
+      <purl>pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six">
+      <name>six</name>
+      <version/>
+      <purl>pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <version/>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi==2023.11.17"/>
+    <dependency ref="charset-normalizer==3.3.2"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="pillow"/>
+    <dependency ref="requests"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.4.json.bin b/tests/_data/snapshots/pipenv/with-urls_1.4.json.bin
new file mode 100644
index 00000000..dfdbdfaa
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.4.json.bin
@@ -0,0 +1,569 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi==2023.11.17",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b469f3a900bf28dc19b8cfbf8019bf47f7fdd1a65a1d4ffb98fc14166beb4d1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e036ab49d5b79556f99cfc2d9320b34cfbe5be05c5871b51de9329f0603b0474"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/certifi@2023.11.17",
+      "type": "library",
+      "version": "2023.11.17"
+    },
+    {
+      "bom-ref": "charset-normalizer==3.3.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2127566c664442652f024c837091890cb1942c30937add288223dc895793f898"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/charset-normalizer/"
+        }
+      ],
+      "name": "charset-normalizer",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/charset-normalizer@3.3.2",
+      "type": "library",
+      "version": "3.3.2"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "pillow",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "pillow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requests",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375"
+        }
+      ],
+      "name": "requests",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375",
+      "type": "library"
+    },
+    {
+      "bom-ref": "six",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
+      "type": "library"
+    },
+    {
+      "bom-ref": "urllib3",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi==2023.11.17"
+    },
+    {
+      "ref": "charset-normalizer==3.3.2"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "pillow"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.4.xml.bin b/tests/_data/snapshots/pipenv/with-urls_1.4.xml.bin
new file mode 100644
index 00000000..5d311776
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.4.xml.bin
@@ -0,0 +1,255 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi==2023.11.17">
+      <name>certifi</name>
+      <version>2023.11.17</version>
+      <purl>pkg:pypi/certifi@2023.11.17</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9b469f3a900bf28dc19b8cfbf8019bf47f7fdd1a65a1d4ffb98fc14166beb4d1</hash>
+            <hash alg="SHA-256">e036ab49d5b79556f99cfc2d9320b34cfbe5be05c5871b51de9329f0603b0474</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="charset-normalizer==3.3.2">
+      <name>charset-normalizer</name>
+      <version>3.3.2</version>
+      <purl>pkg:pypi/charset-normalizer@3.3.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/charset-normalizer/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027</hash>
+            <hash alg="SHA-256">06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087</hash>
+            <hash alg="SHA-256">0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786</hash>
+            <hash alg="SHA-256">0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8</hash>
+            <hash alg="SHA-256">10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09</hash>
+            <hash alg="SHA-256">122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185</hash>
+            <hash alg="SHA-256">1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574</hash>
+            <hash alg="SHA-256">1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e</hash>
+            <hash alg="SHA-256">1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519</hash>
+            <hash alg="SHA-256">2127566c664442652f024c837091890cb1942c30937add288223dc895793f898</hash>
+            <hash alg="SHA-256">22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269</hash>
+            <hash alg="SHA-256">25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3</hash>
+            <hash alg="SHA-256">2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f</hash>
+            <hash alg="SHA-256">3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6</hash>
+            <hash alg="SHA-256">34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8</hash>
+            <hash alg="SHA-256">37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a</hash>
+            <hash alg="SHA-256">3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73</hash>
+            <hash alg="SHA-256">3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc</hash>
+            <hash alg="SHA-256">42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714</hash>
+            <hash alg="SHA-256">45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2</hash>
+            <hash alg="SHA-256">4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc</hash>
+            <hash alg="SHA-256">4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce</hash>
+            <hash alg="SHA-256">4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d</hash>
+            <hash alg="SHA-256">549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e</hash>
+            <hash alg="SHA-256">55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6</hash>
+            <hash alg="SHA-256">572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269</hash>
+            <hash alg="SHA-256">573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96</hash>
+            <hash alg="SHA-256">5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d</hash>
+            <hash alg="SHA-256">6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a</hash>
+            <hash alg="SHA-256">65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4</hash>
+            <hash alg="SHA-256">663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77</hash>
+            <hash alg="SHA-256">6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d</hash>
+            <hash alg="SHA-256">68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0</hash>
+            <hash alg="SHA-256">6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed</hash>
+            <hash alg="SHA-256">6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068</hash>
+            <hash alg="SHA-256">6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac</hash>
+            <hash alg="SHA-256">6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25</hash>
+            <hash alg="SHA-256">753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8</hash>
+            <hash alg="SHA-256">7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab</hash>
+            <hash alg="SHA-256">7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26</hash>
+            <hash alg="SHA-256">7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2</hash>
+            <hash alg="SHA-256">802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db</hash>
+            <hash alg="SHA-256">80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f</hash>
+            <hash alg="SHA-256">8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5</hash>
+            <hash alg="SHA-256">86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99</hash>
+            <hash alg="SHA-256">87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c</hash>
+            <hash alg="SHA-256">8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d</hash>
+            <hash alg="SHA-256">8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811</hash>
+            <hash alg="SHA-256">8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa</hash>
+            <hash alg="SHA-256">8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a</hash>
+            <hash alg="SHA-256">9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03</hash>
+            <hash alg="SHA-256">90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b</hash>
+            <hash alg="SHA-256">923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04</hash>
+            <hash alg="SHA-256">95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c</hash>
+            <hash alg="SHA-256">96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001</hash>
+            <hash alg="SHA-256">9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458</hash>
+            <hash alg="SHA-256">a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389</hash>
+            <hash alg="SHA-256">a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99</hash>
+            <hash alg="SHA-256">a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985</hash>
+            <hash alg="SHA-256">a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537</hash>
+            <hash alg="SHA-256">ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238</hash>
+            <hash alg="SHA-256">aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f</hash>
+            <hash alg="SHA-256">b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d</hash>
+            <hash alg="SHA-256">b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796</hash>
+            <hash alg="SHA-256">b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a</hash>
+            <hash alg="SHA-256">b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143</hash>
+            <hash alg="SHA-256">bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8</hash>
+            <hash alg="SHA-256">beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c</hash>
+            <hash alg="SHA-256">c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5</hash>
+            <hash alg="SHA-256">c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5</hash>
+            <hash alg="SHA-256">c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711</hash>
+            <hash alg="SHA-256">c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4</hash>
+            <hash alg="SHA-256">cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6</hash>
+            <hash alg="SHA-256">d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c</hash>
+            <hash alg="SHA-256">d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7</hash>
+            <hash alg="SHA-256">db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4</hash>
+            <hash alg="SHA-256">ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b</hash>
+            <hash alg="SHA-256">deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae</hash>
+            <hash alg="SHA-256">e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12</hash>
+            <hash alg="SHA-256">e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c</hash>
+            <hash alg="SHA-256">e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae</hash>
+            <hash alg="SHA-256">eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8</hash>
+            <hash alg="SHA-256">eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887</hash>
+            <hash alg="SHA-256">eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b</hash>
+            <hash alg="SHA-256">efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4</hash>
+            <hash alg="SHA-256">f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f</hash>
+            <hash alg="SHA-256">f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5</hash>
+            <hash alg="SHA-256">fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33</hash>
+            <hash alg="SHA-256">fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519</hash>
+            <hash alg="SHA-256">ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca</hash>
+            <hash alg="SHA-256">c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="pillow">
+      <name>pillow</name>
+      <purl>pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <purl>pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six">
+      <name>six</name>
+      <purl>pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi==2023.11.17"/>
+    <dependency ref="charset-normalizer==3.3.2"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="pillow"/>
+    <dependency ref="requests"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin
index b56f3334..ba1579cb 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin
@@ -9,15 +9,9 @@
     </component>
     <component type="library">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <modified>false</modified>
     </component>
-    <component type="library">
-      <name>package-c</name>
-      <version>80.0.85</version>
-      <description/>
-      <modified>false</modified>
-    </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin
index 396c481b..1ad4c028 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin
@@ -7,32 +7,21 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
-      <name>package-c</name>
-      <version>80.0.85</version>
-      <description/>
-      <externalReferences>
-        <reference type="distribution">
-          <url>../local_pckages/c</url>
-          <comment>from directory</comment>
-        </reference>
-      </externalReferences>
-    </component>
   </components>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
index eeaea176..2df1f738 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
@@ -7,7 +7,7 @@
         {
           "comment": "from file",
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -15,40 +15,25 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
           "comment": "from file",
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
       "type": "library",
-      "version": "1.33.7"
-    },
-    {
-      "bom-ref": "package-c@80.0.85",
-      "description": "",
-      "externalReferences": [
-        {
-          "comment": "from directory",
-          "type": "distribution",
-          "url": "../local_pckages/c"
-        }
-      ],
-      "name": "package-c",
-      "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42"
       ],
       "ref": "local"
     },
@@ -56,10 +41,7 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
-    },
-    {
-      "ref": "package-c@80.0.85"
+      "ref": "package-b@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
index 21b02f3a..e4989cef 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
@@ -27,42 +27,29 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
-      <name>package-c</name>
-      <version>80.0.85</version>
-      <description/>
-      <externalReferences>
-        <reference type="distribution">
-          <url>../local_pckages/c</url>
-          <comment>from directory</comment>
-        </reference>
-      </externalReferences>
-    </component>
   </components>
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
index a7252aea..c7362720 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
@@ -9,11 +9,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -27,7 +27,7 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
@@ -35,11 +35,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
@@ -50,35 +50,14 @@
         }
       ],
       "type": "library",
-      "version": "1.33.7"
-    },
-    {
-      "bom-ref": "package-c@80.0.85",
-      "description": "",
-      "externalReferences": [
-        {
-          "comment": "from directory",
-          "type": "distribution",
-          "url": "../local_pckages/c"
-        }
-      ],
-      "name": "package-c",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        }
-      ],
-      "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42"
       ],
       "ref": "local"
     },
@@ -86,10 +65,7 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
-    },
-    {
-      "ref": "package-c@80.0.85"
+      "ref": "package-b@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
index 0e033d63..652604dc 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
@@ -27,10 +27,10 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -38,16 +38,16 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -55,29 +55,13 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
-      <name>package-c</name>
-      <version>80.0.85</version>
-      <description/>
-      <externalReferences>
-        <reference type="distribution">
-          <url>../local_pckages/c</url>
-          <comment>from directory</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-      </properties>
-    </component>
   </components>
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin
index 4f43775a..c6aa1de9 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin
@@ -9,11 +9,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -27,7 +27,7 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
@@ -35,11 +35,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
@@ -50,35 +50,14 @@
         }
       ],
       "type": "library",
-      "version": "1.33.7"
-    },
-    {
-      "bom-ref": "package-c@80.0.85",
-      "description": "",
-      "externalReferences": [
-        {
-          "comment": "from directory",
-          "type": "distribution",
-          "url": "../local_pckages/c"
-        }
-      ],
-      "name": "package-c",
-      "properties": [
-        {
-          "name": "cdx:poetry:group",
-          "value": "main"
-        }
-      ],
-      "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42"
       ],
       "ref": "local"
     },
@@ -86,10 +65,7 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
-    },
-    {
-      "ref": "package-c@80.0.85"
+      "ref": "package-b@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin
index 7dc04900..0d9d88be 100644
--- a/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin
@@ -54,10 +54,10 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -65,16 +65,16 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -82,29 +82,13 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
-      <name>package-c</name>
-      <version>80.0.85</version>
-      <description/>
-      <externalReferences>
-        <reference type="distribution">
-          <url>../local_pckages/c</url>
-          <comment>from directory</comment>
-        </reference>
-      </externalReferences>
-      <properties>
-        <property name="cdx:poetry:group">main</property>
-      </properties>
-    </component>
   </components>
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin
index 6f4c891b..13deb487 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin
@@ -9,13 +9,13 @@
     </component>
     <component type="library">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin
index 1df48126..973910a9 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin
@@ -7,29 +7,29 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
index 9f8f2d25..eb07f486 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
@@ -7,7 +7,7 @@
         {
           "comment": "from file",
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -15,40 +15,40 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
           "comment": "from file",
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
       "type": "library",
-      "version": "1.33.7"
+      "version": "23.42"
     },
     {
-      "bom-ref": "package-c@80.0.85",
+      "bom-ref": "package-c@23.42",
       "description": "some package C",
       "externalReferences": [
         {
           "comment": "from directory",
           "type": "distribution",
-          "url": "../local_pckages/c"
+          "url": "../../../_helpers/local_pckages/c"
         }
       ],
       "name": "package-c",
       "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42",
+        "package-c@23.42"
       ],
       "ref": "local"
     },
@@ -56,10 +56,10 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
+      "ref": "package-b@23.42"
     },
     {
-      "ref": "package-c@80.0.85"
+      "ref": "package-c@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
index 1e0219bf..74bdf4f8 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
@@ -27,29 +27,29 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
@@ -58,11 +58,11 @@
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
index 64ca561d..b2f470fb 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
@@ -9,11 +9,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -27,7 +27,7 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
@@ -35,11 +35,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
@@ -50,16 +50,16 @@
         }
       ],
       "type": "library",
-      "version": "1.33.7"
+      "version": "23.42"
     },
     {
-      "bom-ref": "package-c@80.0.85",
+      "bom-ref": "package-c@23.42",
       "description": "some package C",
       "externalReferences": [
         {
           "comment": "from directory",
           "type": "distribution",
-          "url": "../local_pckages/c"
+          "url": "../../../_helpers/local_pckages/c"
         }
       ],
       "name": "package-c",
@@ -70,15 +70,15 @@
         }
       ],
       "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42",
+        "package-c@23.42"
       ],
       "ref": "local"
     },
@@ -86,10 +86,10 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
+      "ref": "package-b@23.42"
     },
     {
-      "ref": "package-c@80.0.85"
+      "ref": "package-c@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
index 80480295..65da5a87 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
@@ -27,10 +27,10 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -38,16 +38,16 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -55,13 +55,13 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
@@ -73,11 +73,11 @@
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin
index 0dc6df14..57ee0bd6 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin
@@ -9,11 +9,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -27,7 +27,7 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
@@ -35,11 +35,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
@@ -50,16 +50,16 @@
         }
       ],
       "type": "library",
-      "version": "1.33.7"
+      "version": "23.42"
     },
     {
-      "bom-ref": "package-c@80.0.85",
+      "bom-ref": "package-c@23.42",
       "description": "some package C",
       "externalReferences": [
         {
           "comment": "from directory",
           "type": "distribution",
-          "url": "../local_pckages/c"
+          "url": "../../../_helpers/local_pckages/c"
         }
       ],
       "name": "package-c",
@@ -70,15 +70,15 @@
         }
       ],
       "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42",
+        "package-c@23.42"
       ],
       "ref": "local"
     },
@@ -86,10 +86,10 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
+      "ref": "package-b@23.42"
     },
     {
-      "ref": "package-c@80.0.85"
+      "ref": "package-c@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin
index b5b233b6..e7e26904 100644
--- a/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin
@@ -54,10 +54,10 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -65,16 +65,16 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -82,13 +82,13 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
@@ -100,11 +100,11 @@
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin
index 6f4c891b..13deb487 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin
@@ -9,13 +9,13 @@
     </component>
     <component type="library">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <modified>false</modified>
     </component>
     <component type="library">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <modified>false</modified>
     </component>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin
index 1df48126..973910a9 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin
@@ -7,29 +7,29 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
index 9f8f2d25..eb07f486 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
@@ -7,7 +7,7 @@
         {
           "comment": "from file",
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -15,40 +15,40 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
           "comment": "from file",
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
       "type": "library",
-      "version": "1.33.7"
+      "version": "23.42"
     },
     {
-      "bom-ref": "package-c@80.0.85",
+      "bom-ref": "package-c@23.42",
       "description": "some package C",
       "externalReferences": [
         {
           "comment": "from directory",
           "type": "distribution",
-          "url": "../local_pckages/c"
+          "url": "../../../_helpers/local_pckages/c"
         }
       ],
       "name": "package-c",
       "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42",
+        "package-c@23.42"
       ],
       "ref": "local"
     },
@@ -56,10 +56,10 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
+      "ref": "package-b@23.42"
     },
     {
-      "ref": "package-c@80.0.85"
+      "ref": "package-c@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
index 1e0219bf..74bdf4f8 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
@@ -27,29 +27,29 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
         </reference>
       </externalReferences>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
@@ -58,11 +58,11 @@
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
index 64ca561d..b2f470fb 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
@@ -9,11 +9,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -27,7 +27,7 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
@@ -35,11 +35,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
@@ -50,16 +50,16 @@
         }
       ],
       "type": "library",
-      "version": "1.33.7"
+      "version": "23.42"
     },
     {
-      "bom-ref": "package-c@80.0.85",
+      "bom-ref": "package-c@23.42",
       "description": "some package C",
       "externalReferences": [
         {
           "comment": "from directory",
           "type": "distribution",
-          "url": "../local_pckages/c"
+          "url": "../../../_helpers/local_pckages/c"
         }
       ],
       "name": "package-c",
@@ -70,15 +70,15 @@
         }
       ],
       "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42",
+        "package-c@23.42"
       ],
       "ref": "local"
     },
@@ -86,10 +86,10 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
+      "ref": "package-b@23.42"
     },
     {
-      "ref": "package-c@80.0.85"
+      "ref": "package-c@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
index 80480295..65da5a87 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
@@ -27,10 +27,10 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -38,16 +38,16 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -55,13 +55,13 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
@@ -73,11 +73,11 @@
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin
index 0dc6df14..57ee0bd6 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin
@@ -9,11 +9,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937"
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/a/dist/package_a-23.42.tar.gz"
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
         }
       ],
       "name": "package-a",
@@ -27,7 +27,7 @@
       "version": "23.42"
     },
     {
-      "bom-ref": "package-b@1.33.7",
+      "bom-ref": "package-b@23.42",
       "description": "some package B",
       "externalReferences": [
         {
@@ -35,11 +35,11 @@
           "hashes": [
             {
               "alg": "SHA-256",
-              "content": "9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce"
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
             }
           ],
           "type": "distribution",
-          "url": "../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl"
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
         }
       ],
       "name": "package-b",
@@ -50,16 +50,16 @@
         }
       ],
       "type": "library",
-      "version": "1.33.7"
+      "version": "23.42"
     },
     {
-      "bom-ref": "package-c@80.0.85",
+      "bom-ref": "package-c@23.42",
       "description": "some package C",
       "externalReferences": [
         {
           "comment": "from directory",
           "type": "distribution",
-          "url": "../local_pckages/c"
+          "url": "../../../_helpers/local_pckages/c"
         }
       ],
       "name": "package-c",
@@ -70,15 +70,15 @@
         }
       ],
       "type": "library",
-      "version": "80.0.85"
+      "version": "23.42"
     }
   ],
   "dependencies": [
     {
       "dependsOn": [
         "package-a@23.42",
-        "package-b@1.33.7",
-        "package-c@80.0.85"
+        "package-b@23.42",
+        "package-c@23.42"
       ],
       "ref": "local"
     },
@@ -86,10 +86,10 @@
       "ref": "package-a@23.42"
     },
     {
-      "ref": "package-b@1.33.7"
+      "ref": "package-b@23.42"
     },
     {
-      "ref": "package-c@80.0.85"
+      "ref": "package-c@23.42"
     }
   ],
   "metadata": {
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin
index b5b233b6..e7e26904 100644
--- a/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin
@@ -54,10 +54,10 @@
       <description>some package A</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/a/dist/package_a-23.42.tar.gz</url>
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">ae88a53d80bf9703baa9c22c8e713f5199dde0445a6a246593bee36fca2be937</hash>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -65,16 +65,16 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-b@1.33.7">
+    <component type="library" bom-ref="package-b@23.42">
       <name>package-b</name>
-      <version>1.33.7</version>
+      <version>23.42</version>
       <description>some package B</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/b/dist/package_b-1.33.7-py2.py3-none-any.whl</url>
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
           <comment>from file</comment>
           <hashes>
-            <hash alg="SHA-256">9dabd70588b919932d5ca273135d5c8b80ebd111a7e2c1d785c14ddf00d180ce</hash>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
           </hashes>
         </reference>
       </externalReferences>
@@ -82,13 +82,13 @@
         <property name="cdx:poetry:group">main</property>
       </properties>
     </component>
-    <component type="library" bom-ref="package-c@80.0.85">
+    <component type="library" bom-ref="package-c@23.42">
       <name>package-c</name>
-      <version>80.0.85</version>
+      <version>23.42</version>
       <description>some package C</description>
       <externalReferences>
         <reference type="distribution">
-          <url>../local_pckages/c</url>
+          <url>../../../_helpers/local_pckages/c</url>
           <comment>from directory</comment>
         </reference>
       </externalReferences>
@@ -100,11 +100,11 @@
   <dependencies>
     <dependency ref="local">
       <dependency ref="package-a@23.42"/>
-      <dependency ref="package-b@1.33.7"/>
-      <dependency ref="package-c@80.0.85"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
     </dependency>
     <dependency ref="package-a@23.42"/>
-    <dependency ref="package-b@1.33.7"/>
-    <dependency ref="package-c@80.0.85"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
   </dependencies>
 </bom>
diff --git a/tests/fixtures/poetry-lock-regression-issue611.txt.bin b/tests/fixtures/poetry-lock-regression-issue611.txt.bin
deleted file mode 100644
index 3f7817c1..00000000
--- a/tests/fixtures/poetry-lock-regression-issue611.txt.bin
+++ /dev/null
@@ -1,17 +0,0 @@
-# This file is automatically @generated by Poetry 1.6.1 and should not be changed by hand.
-
-[[package]]
-name = "pyhumps"
-version = "3.7.1"
-description = "🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node"
-optional = false
-python-versions = "*"
-files = [
-    {file = "pyhumps-3.7.1-py3-none-any.whl", hash = "sha256:c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e"},
-    {file = "pyhumps-3.7.1.tar.gz", hash = "sha256:5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da"},
-]
-
-[metadata]
-lock-version = "2.0"
-python-versions = "^3.11"
-content-hash = "e9676d347231afe6a46e027d88442e90348436b55346267e68a37e340c5f8f6f"
diff --git a/tests/integration/test_pipenv.py b/tests/integration/test_pipenv.py
new file mode 100644
index 00000000..fa631f56
--- /dev/null
+++ b/tests/integration/test_pipenv.py
@@ -0,0 +1,173 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+import random
+from contextlib import redirect_stderr, redirect_stdout
+from glob import glob
+from io import StringIO
+from os.path import basename, dirname, join
+from typing import Any, Generator
+from unittest import TestCase
+
+from cyclonedx.schema import OutputFormat, SchemaVersion
+from ddt import ddt, named_data
+
+from cyclonedx_py._internal.cli import run as run_cli
+from tests import INFILES_DIRECTORY, SUPPORTED_OF_SV, SnapshotMixin, make_comparable
+
+lockfiles = glob(join(INFILES_DIRECTORY, 'pipenv', '*', 'Pipfile.lock'))
+projectdirs = list(dirname(lockfile) for lockfile in lockfiles)
+
+test_data = tuple(
+    (f'{basename(dirname(projectdir))}-{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
+    for projectdir in projectdirs
+    for of, sv in SUPPORTED_OF_SV
+)
+
+
+def test_data_file_filter(s: str) -> Generator[Any, None, None]:
+    return ((n, d, sv, of) for n, d, sv, of in test_data if s in n)
+
+
+@ddt
+class TestPipenv(TestCase, SnapshotMixin):
+
+    def test_cli_fails_with_dir_not_found(self) -> None:
+        _, projectdir, sv, of = random.choice(test_data)  # nosec B311
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'pipenv',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    'something-that-must-not-exist.testing'])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn('Could not open lock file: something-that-must-not-exist.testing', err)
+
+    def test_cli_with_pyproject_not_found(self) -> None:
+        _, projectdir, sv, of = random.choice(test_data)  # nosec B311
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'pipenv',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    '--pyproject=something-that-must-not-exist.testing',
+                    projectdir
+                ])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn('Could not open pyproject file: something-that-must-not-exist.testing', err)
+
+    @named_data(*test_data)
+    def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'pipenv',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    f'--pyproject={join(projectdir, "pyproject.toml")}',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+
+    @named_data(*test_data_file_filter('category-deps'))
+    def test_cli_with_categories_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'pipenv',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    '--categories', 'categoryB,groupA packages,dev-packages',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'some-categories_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+
+    @named_data(*test_data_file_filter('default-and-dev'))
+    def test_cli_with_dev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'pipenv',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    '--dev',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'with-dev_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+
+    @named_data(*test_data_file_filter('private-packages'))
+    def test_cli_with_pypi_mirror_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'pipenv',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    '--pypi-mirror', 'https://pypy-mirror.testing.acme.org/simple',
+                    projectdir])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(
+            make_comparable(out, of),
+            f'pypi-mirror_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+
+    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa:N802
+        super().assertEqualSnapshot(actual, join('pipenv', snapshot_name))
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index abfc6e22..23c5b507 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -28,23 +28,16 @@
 from ddt import ddt, named_data
 
 from cyclonedx_py._internal.cli import run as run_cli
-from tests import INFILES_DIRECTORY, SnapshotMixin, make_comparable
+from tests import INFILES_DIRECTORY, SUPPORTED_OF_SV, SnapshotMixin, make_comparable
 
 lockfiles = glob(join(INFILES_DIRECTORY, 'poetry', '*', '*', 'poetry.lock'))
 projectdirs = list(dirname(lockfile) for lockfile in lockfiles)
 
-unsupported_of_sf = [
-    (OutputFormat.JSON, SchemaVersion.V1_1),
-    (OutputFormat.JSON, SchemaVersion.V1_0),
-]
-
-test_data = [
+test_data = tuple(
     (f'{basename(dirname(projectdir))}-{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
     for projectdir in projectdirs
-    for sv in SchemaVersion
-    for of in OutputFormat
-    if (of, sv) not in unsupported_of_sf
-]
+    for of, sv in SUPPORTED_OF_SV
+)
 
 
 def test_data_file_filter(s: str) -> Generator[Any, None, None]:
@@ -55,6 +48,7 @@ def test_data_file_filter(s: str) -> Generator[Any, None, None]:
 class TestPoetry(TestCase, SnapshotMixin):
 
     def test_cli_fails_with_dir_not_found(self) -> None:
+        _, projectdir, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -62,8 +56,8 @@ def test_cli_fails_with_dir_not_found(self) -> None:
                 res = run_cli(argv=[
                     'poetry',
                     '-vvv',
-                    f'--sv={SchemaVersion.V1_4.to_version()}',
-                    f'--of={OutputFormat.XML.name}',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
                     '--outfile=-',
                     'something-that-must-not-exist.testing'])
             err = err.getvalue()
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 63db8191..410824b6 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -30,24 +30,18 @@
 from ddt import ddt, named_data
 
 from cyclonedx_py._internal.cli import run as run_cli
-from tests import INFILES_DIRECTORY, SnapshotMixin, make_comparable
+from tests import INFILES_DIRECTORY, SUPPORTED_OF_SV, SnapshotMixin, make_comparable
 
 infiles = glob(join(INFILES_DIRECTORY, 'requirements', '*.txt*'))
 
 pyproject_file = join(INFILES_DIRECTORY, 'requirements', 'pyproject.toml')
 
-unsupported_of_sf = [
-    (OutputFormat.JSON, SchemaVersion.V1_1),
-    (OutputFormat.JSON, SchemaVersion.V1_0),
-]
 
-test_data = [
+test_data = tuple(
     (f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of)
     for infile in infiles
-    for sv in SchemaVersion
-    for of in OutputFormat
-    if (of, sv) not in unsupported_of_sf
-]
+    for of, sv in SUPPORTED_OF_SV
+)
 
 if os.name == 'nt':
     def test_data_os_filter(data: Any) -> bool:
@@ -62,6 +56,7 @@ def test_data_os_filter(data: Tuple[Any, str, Any, Any]) -> bool:
 class TestRequirements(TestCase, SnapshotMixin):
 
     def test_cli_with_file_not_found(self) -> None:
+        _, infile, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -69,8 +64,8 @@ def test_cli_with_file_not_found(self) -> None:
                 res = run_cli(argv=[
                     'requirements',
                     '-vvv',
-                    f'--sv={SchemaVersion.V1_4.to_version()}',
-                    f'--of={OutputFormat.XML.name}',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
                     '--outfile=-',
                     'something-that-must-not-exist.testing'])
             err = err.getvalue()
@@ -79,6 +74,7 @@ def test_cli_with_file_not_found(self) -> None:
         self.assertIn('Could not open requirements file: something-that-must-not-exist.testing', err)
 
     def test_cli_with_pyproject_not_found(self) -> None:
+        _, infile, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -86,11 +82,11 @@ def test_cli_with_pyproject_not_found(self) -> None:
                 res = run_cli(argv=[
                     'requirements',
                     '-vvv',
-                    f'--sv={SchemaVersion.V1_4.to_version()}',
-                    f'--of={OutputFormat.XML.name}',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
                     '--outfile=-',
                     '--pyproject=something-that-must-not-exist.testing',
-                    random.choice(test_data)  # nosec B311
+                    infile
                 ])
             err = err.getvalue()
             out = out.getvalue()

From e20edbfe6e1642c3bc86ccecfec0217d5fcfa6d6 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 15 Dec 2023 17:16:06 +0100
Subject: [PATCH 138/155] cli

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py          |  4 +-
 cyclonedx_py/_internal/conda.py        | 77 ++++++++++++++++++++++++++
 cyclonedx_py/_internal/environment.py  |  2 +-
 cyclonedx_py/_internal/requirements.py |  2 +-
 4 files changed, 82 insertions(+), 3 deletions(-)
 create mode 100644 cyclonedx_py/_internal/conda.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 9ebe5539..086514ef 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -28,6 +28,7 @@
 from .pipenv import PipenvBB
 from .poetry import PoetryBB
 from .requirements import RequirementsBB
+from .conda import CondaBB
 
 if TYPE_CHECKING:  # pragma: no cover
     from argparse import Action
@@ -111,9 +112,10 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
         scbbc: Type['BomBuilder']
         for sct, scbbc in (  # type:ignore[assignment]
             ('environment', EnvironmentBB),
+            ('requirements', RequirementsBB),
             ('pipenv', PipenvBB),
             ('poetry', PoetryBB),
-            ('requirements', RequirementsBB),
+            ('conda', CondaBB),
         ):
             spp = scbbc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
diff --git a/cyclonedx_py/_internal/conda.py b/cyclonedx_py/_internal/conda.py
new file mode 100644
index 00000000..0e57eccd
--- /dev/null
+++ b/cyclonedx_py/_internal/conda.py
@@ -0,0 +1,77 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from typing import TYPE_CHECKING, Any, BinaryIO
+
+from . import BomBuilder
+
+if TYPE_CHECKING:  # pragma: no cover
+    from argparse import ArgumentParser
+    from logging import Logger
+
+    from cyclonedx.model.bom import Bom
+
+
+# !!! be as lazy loading as possible, as greedy as needed
+# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
+
+
+class CondaBB(BomBuilder):
+
+    @staticmethod
+    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
+        from argparse import ArgumentParser
+
+        p = ArgumentParser(description='Build an SBOM from a conda environment',
+                           **kwargs)
+        # TODO
+        return p
+
+    def __init__(self, *,
+                 logger: 'Logger',
+                 **__: Any) -> None:
+        self._logger = logger
+
+    def __call__(self, *,  # type:ignore[override]
+                 lock: BinaryIO,
+                 **__: Any) -> 'Bom':
+        from .utils.bom import make_bom
+
+        bom = make_bom()
+
+        # TODO
+
+        # maybe shell-out (forward all env cars starting with `CONDA_`)
+        #
+        # see also: https://docs.conda.io/projects/conda/en/latest/user-guide/configuration/use-condarc.html
+        # see also: https://docs.conda.io/projects/conda/en/latest/dev-guide/deep-dives/context.html
+        #
+        # - `conda list -q [-n ENVIRONMENT] [-p PATH] [--no-pip] [-f] [FILTER]`
+        #   - `conda list --json`
+        #   - `conda list --export --explicit --md5`
+        # - `conda info`
+
+        # maybe have an own conda command/plugin?
+        # see https://docs.conda.io/projects/conda/en/latest/user-guide/concepts/conda-plugins.html
+
+        # maybe create a executable `conda-cyclonedx`
+        # if it is in the shell path, conda will pick it up and have it made available via `conda cyclonedx`
+        # and it will add some env vars:
+        # - CONDA_ROOT
+
+        return bom
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 398d22a5..d8904d3d 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -37,7 +37,7 @@ class EnvironmentBB(BomBuilder):
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import ArgumentParser
 
-        p = ArgumentParser(description='Build an SBOM from Python environment',
+        p = ArgumentParser(description='Build an SBOM from Python (virtual) environment',
                            **kwargs)
         # TODO
         return p
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index ac3ece1d..f78b44f8 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -45,7 +45,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
 
         from .utils.args import argparse_type4enum
 
-        p = ArgumentParser(description=dedent(""""\
+        p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pip requirements.
 
                            The options mimic the respective ones from Pip.

From 59327b2aa0c1a8c4098691e5ca10149741eeed72 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 15 Dec 2023 18:45:54 +0100
Subject: [PATCH 139/155] drop poetry

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py   |  2 -
 cyclonedx_py/_internal/conda.py | 77 ---------------------------------
 2 files changed, 79 deletions(-)
 delete mode 100644 cyclonedx_py/_internal/conda.py

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index 086514ef..e54cedbf 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -28,7 +28,6 @@
 from .pipenv import PipenvBB
 from .poetry import PoetryBB
 from .requirements import RequirementsBB
-from .conda import CondaBB
 
 if TYPE_CHECKING:  # pragma: no cover
     from argparse import Action
@@ -115,7 +114,6 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
             ('requirements', RequirementsBB),
             ('pipenv', PipenvBB),
             ('poetry', PoetryBB),
-            ('conda', CondaBB),
         ):
             spp = scbbc.make_argument_parser(add_help=False)
             sp.add_parser(sct,
diff --git a/cyclonedx_py/_internal/conda.py b/cyclonedx_py/_internal/conda.py
deleted file mode 100644
index 0e57eccd..00000000
--- a/cyclonedx_py/_internal/conda.py
+++ /dev/null
@@ -1,77 +0,0 @@
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
-from typing import TYPE_CHECKING, Any, BinaryIO
-
-from . import BomBuilder
-
-if TYPE_CHECKING:  # pragma: no cover
-    from argparse import ArgumentParser
-    from logging import Logger
-
-    from cyclonedx.model.bom import Bom
-
-
-# !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
-
-
-class CondaBB(BomBuilder):
-
-    @staticmethod
-    def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import ArgumentParser
-
-        p = ArgumentParser(description='Build an SBOM from a conda environment',
-                           **kwargs)
-        # TODO
-        return p
-
-    def __init__(self, *,
-                 logger: 'Logger',
-                 **__: Any) -> None:
-        self._logger = logger
-
-    def __call__(self, *,  # type:ignore[override]
-                 lock: BinaryIO,
-                 **__: Any) -> 'Bom':
-        from .utils.bom import make_bom
-
-        bom = make_bom()
-
-        # TODO
-
-        # maybe shell-out (forward all env cars starting with `CONDA_`)
-        #
-        # see also: https://docs.conda.io/projects/conda/en/latest/user-guide/configuration/use-condarc.html
-        # see also: https://docs.conda.io/projects/conda/en/latest/dev-guide/deep-dives/context.html
-        #
-        # - `conda list -q [-n ENVIRONMENT] [-p PATH] [--no-pip] [-f] [FILTER]`
-        #   - `conda list --json`
-        #   - `conda list --export --explicit --md5`
-        # - `conda info`
-
-        # maybe have an own conda command/plugin?
-        # see https://docs.conda.io/projects/conda/en/latest/user-guide/concepts/conda-plugins.html
-
-        # maybe create a executable `conda-cyclonedx`
-        # if it is in the shell path, conda will pick it up and have it made available via `conda cyclonedx`
-        # and it will add some env vars:
-        # - CONDA_ROOT
-
-        return bom

From 01049fb23d4c419cb28c32d9e4c68777b8ee2af9 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 15 Dec 2023 19:17:39 +0100
Subject: [PATCH 140/155] docs related to #622

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 README.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 160e1676..938a9baa 100644
--- a/README.md
+++ b/README.md
@@ -13,15 +13,17 @@
 
 ----
 
-This project provides a runnable Python-based application for generating CycloneDX bill-of-material documents from either:
+This project provides a runnable Python-based application 
+for generating software bill-of-material (SBOM) documents in [CycloneDX](https://cyclonedx.org/) format
+from either:
 
 * Your current Python Environment
 * Your project's manifest (e.g. `Pipfile.lock`, `poetry.lock` or `requirements.txt`)
-* Conda as a Package Manager
+* Conda as a Package Manager is no longer supported since version 4. Try an older version: `pip install 'cyclonedx-bom<4'`
 
-The BOM will contain an aggregate of all your current project's dependencies, or those defined by the manifest you supply.
+The SBOM will contain an aggregate of all your current project's dependencies, or those defined by the manifest you supply.
 
-[CycloneDX](https://cyclonedx.org/) is a lightweight BOM specification that is easily created, human-readable, and simple to parse.
+CycloneDX is a lightweight BOM specification that is easily created, human-readable, and simple to parse.
 
 Read the full [documentation][link_rtfd] for more details.
 

From 01a1bedaea36b7939e1e375bc94b2d0fd9659ff6 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 16 Dec 2023 05:15:51 +0100
Subject: [PATCH 141/155] docs requirements

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/requirements.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index f78b44f8..b9a2e101 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -58,6 +58,10 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                                    $ cat requirements/*.txt | %(prog)s -
                              • Build an inventory for all installed packages:
                                    $ python3 -m pip freeze --all | %(prog)s -
+                             • Build an inventory for all installed packages in a conda environment:
+                                   $ conda run python3 -m pip freeze --all | %(prog)s -
+                             • Build an inventory for installed packages in a virtual environment:
+                                   $ .../venv/bin/python3 -m pip freeze --all --local --require-virtualenv | %(prog)s -
                              • Build an inventory from an unfrozen manifest:
                                    $ python3 -m pip install -r dependencies.txt &&\\
                                      python3 -m pip freeze | %(prog)s -

From 55048e4c4a7c6ea06ee61cfedc0e51c42f1b5ac5 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 16 Dec 2023 05:18:32 +0100
Subject: [PATCH 142/155] docs

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/pipenv.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 533b7bd7..2f3edf62 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -42,12 +42,17 @@ class PipenvBB(BomBuilder):
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from os import getenv
+        from textwrap import dedent
 
         from cyclonedx.model.component import ComponentType
 
         from .utils.args import argparse_type4enum, arpaese_split
 
-        p = ArgumentParser(description='Build an SBOM from Pipenv',
+        p = ArgumentParser(description=dedent("""\
+                           Build an SBOM from Pipenv.
+
+                           The options mimic the respective ones from Pipenv.
+                           """),
                            **kwargs)
         # the args shall mimic the ones from Pipenv
         # see also: https://pipenv.pypa.io/en/latest/configuration.html

From fd90acc5b09b287acd685dcde081dc7a59c5a334 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sat, 16 Dec 2023 17:47:27 +0100
Subject: [PATCH 143/155] feat: improved license detection (#626)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/environment.py         |   2 +-
 cyclonedx_py/_internal/pipenv.py              |   2 +-
 cyclonedx_py/_internal/poetry.py              |  18 +-
 cyclonedx_py/_internal/requirements.py        |   2 +-
 .../_internal/utils/{bom.py => cdx.py}        |  15 +-
 .../utils/license_trove_classifier.py         | 163 ++++++++++++++++++
 cyclonedx_py/_internal/utils/pep621.py        |  40 ++++-
 .../infiles/pipenv/no-deps/pyproject.toml     |   9 +-
 .../poetry/no-deps/pyproject-proto.toml       |   8 +-
 .../_data/infiles/requirements/pyproject.toml |   9 +-
 .../snapshots/pipenv/no-deps_1.2.json.bin     |   5 +
 .../snapshots/pipenv/no-deps_1.2.xml.bin      |   3 +
 .../snapshots/pipenv/no-deps_1.3.json.bin     |   5 +
 .../snapshots/pipenv/no-deps_1.3.xml.bin      |   3 +
 .../snapshots/pipenv/no-deps_1.4.json.bin     |   5 +
 .../snapshots/pipenv/no-deps_1.4.xml.bin      |   3 +
 .../poetry/no-deps-lock20-1.2.json.bin        |   4 +-
 .../poetry/no-deps-lock20-1.2.xml.bin         |   4 +-
 .../poetry/no-deps-lock20-1.3.json.bin        |   4 +-
 .../poetry/no-deps-lock20-1.3.xml.bin         |   4 +-
 .../poetry/no-deps-lock20-1.4.json.bin        |   4 +-
 .../poetry/no-deps-lock20-1.4.xml.bin         |   4 +-
 .../requirements/frozen.txt-1.2.json-file.bin |   5 +
 .../requirements/frozen.txt-1.2.xml-file.bin  |   3 +
 .../requirements/frozen.txt-1.3.json-file.bin |   5 +
 .../requirements/frozen.txt-1.3.xml-file.bin  |   3 +
 .../requirements/frozen.txt-1.4.json-file.bin |   5 +
 .../requirements/frozen.txt-1.4.xml-file.bin  |   3 +
 .../requirements/local.txt-1.2.json-file.bin  |   5 +
 .../requirements/local.txt-1.2.xml-file.bin   |   3 +
 .../requirements/local.txt-1.3.json-file.bin  |   5 +
 .../requirements/local.txt-1.3.xml-file.bin   |   3 +
 .../requirements/local.txt-1.4.json-file.bin  |   5 +
 .../requirements/local.txt-1.4.xml-file.bin   |   3 +
 .../requirements/nested.txt-1.2.json-file.bin |   5 +
 .../requirements/nested.txt-1.2.xml-file.bin  |   3 +
 .../requirements/nested.txt-1.3.json-file.bin |   5 +
 .../requirements/nested.txt-1.3.xml-file.bin  |   3 +
 .../requirements/nested.txt-1.4.json-file.bin |   5 +
 .../requirements/nested.txt-1.4.xml-file.bin  |   3 +
 .../private-packages.txt-1.2.json-file.bin    |   5 +
 .../private-packages.txt-1.2.xml-file.bin     |   3 +
 .../private-packages.txt-1.3.json-file.bin    |   5 +
 .../private-packages.txt-1.3.xml-file.bin     |   3 +
 .../private-packages.txt-1.4.json-file.bin    |   5 +
 .../private-packages.txt-1.4.xml-file.bin     |   3 +
 ...-issue448.cp1252.txt.bin-1.2.json-file.bin |   5 +
 ...n-issue448.cp1252.txt.bin-1.2.xml-file.bin |   3 +
 ...-issue448.cp1252.txt.bin-1.3.json-file.bin |   5 +
 ...n-issue448.cp1252.txt.bin-1.3.xml-file.bin |   3 +
 ...-issue448.cp1252.txt.bin-1.4.json-file.bin |   5 +
 ...n-issue448.cp1252.txt.bin-1.4.xml-file.bin |   3 +
 .../with-comments.txt-1.2.json-file.bin       |   5 +
 .../with-comments.txt-1.2.xml-file.bin        |   3 +
 .../with-comments.txt-1.3.json-file.bin       |   5 +
 .../with-comments.txt-1.3.xml-file.bin        |   3 +
 .../with-comments.txt-1.4.json-file.bin       |   5 +
 .../with-comments.txt-1.4.xml-file.bin        |   3 +
 .../with-extras.txt-1.2.json-file.bin         |   5 +
 .../with-extras.txt-1.2.xml-file.bin          |   3 +
 .../with-extras.txt-1.3.json-file.bin         |   5 +
 .../with-extras.txt-1.3.xml-file.bin          |   3 +
 .../with-extras.txt-1.4.json-file.bin         |   5 +
 .../with-extras.txt-1.4.xml-file.bin          |   3 +
 .../with-hashes.txt-1.2.json-file.bin         |   5 +
 .../with-hashes.txt-1.2.xml-file.bin          |   3 +
 .../with-hashes.txt-1.3.json-file.bin         |   5 +
 .../with-hashes.txt-1.3.xml-file.bin          |   3 +
 .../with-hashes.txt-1.4.json-file.bin         |   5 +
 .../with-hashes.txt-1.4.xml-file.bin          |   3 +
 .../with-urls.txt-1.2.json-file.bin           |   5 +
 .../with-urls.txt-1.2.xml-file.bin            |   3 +
 .../with-urls.txt-1.3.json-file.bin           |   5 +
 .../with-urls.txt-1.3.xml-file.bin            |   3 +
 .../with-urls.txt-1.4.json-file.bin           |   5 +
 .../with-urls.txt-1.4.xml-file.bin            |   3 +
 ...hout-pinned-versions.txt-1.2.json-file.bin |   5 +
 ...thout-pinned-versions.txt-1.2.xml-file.bin |   3 +
 ...hout-pinned-versions.txt-1.3.json-file.bin |   5 +
 ...thout-pinned-versions.txt-1.3.xml-file.bin |   3 +
 ...hout-pinned-versions.txt-1.4.json-file.bin |   5 +
 ...thout-pinned-versions.txt-1.4.xml-file.bin |   3 +
 tests/functional/__init__.py                  |  16 ++
 .../test_license_trove_classifier.py          |  32 ++++
 84 files changed, 570 insertions(+), 34 deletions(-)
 rename cyclonedx_py/_internal/utils/{bom.py => cdx.py} (87%)
 create mode 100644 cyclonedx_py/_internal/utils/license_trove_classifier.py
 create mode 100644 tests/functional/__init__.py
 create mode 100644 tests/functional/test_license_trove_classifier.py

diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index d8904d3d..fcae8367 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -50,7 +50,7 @@ def __init__(self, *,
     def __call__(self, *,  # type:ignore[override]
                  lock: BinaryIO,
                  **__: Any) -> 'Bom':
-        from .utils.bom import make_bom
+        from .utils.cdx import make_bom
 
         bom = make_bom()
 
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 2f3edf62..31a38250 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -157,7 +157,7 @@ def _make_bom(self, root_c: Optional['Component'],
         from packageurl import PackageURL
 
         from . import PropertyName
-        from .utils.bom import make_bom
+        from .utils.cdx import make_bom
 
         self._logger.debug('use_groups: %r', use_groups)
 
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index ee8f32cc..ef4550e9 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -29,6 +29,7 @@
     from cyclonedx.model import ExternalReference
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component, ComponentType
+    from cyclonedx.model.license import License
 
     NameDict = Dict[str, Any]
 
@@ -231,7 +232,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
         from cyclonedx.model import Property
 
         from . import PropertyName
-        from .utils.bom import make_bom
+        from .utils.cdx import make_bom
 
         self._logger.debug('use_groups: %r', use_groups)
         self._logger.debug('use_extras: %r', use_extras)
@@ -336,6 +337,19 @@ def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') ->
         from cyclonedx.factory.license import LicenseFactory
         from cyclonedx.model.component import Component
 
+        from .utils.cdx import licenses_fixup
+        from .utils.pep621 import classifiers2licenses
+
+        licenses: List['License'] = []
+        lfac = LicenseFactory()
+        if 'classifiers' in po_cfg:
+            # https://python-poetry.org/docs/pyproject/#classifiers
+            licenses.extend(classifiers2licenses(po_cfg['classifiers'], lfac))
+        if 'license' in po_cfg:
+            # https://python-poetry.org/docs/pyproject/#license
+            licenses.append(lfac.make_from_string(po_cfg['license']))
+        del lfac
+
         # see spec: https://python-poetry.org/docs/pyproject/
         return Component(
             bom_ref=str(po_cfg.get('name', 'root-component')),
@@ -343,7 +357,7 @@ def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') ->
             name=str(po_cfg.get('name', 'unnamed')),
             version=str(po_cfg.get('version', '')) or None,
             description=str(po_cfg.get('description', '')) or None,
-            licenses=[LicenseFactory().make_from_string(po_cfg['license'])] if 'license' in po_cfg else None,
+            licenses=licenses_fixup(licenses),
             author=' | '.join(po_cfg['authors']) if 'authors' in po_cfg else None,
             external_references=self.__extrefs4poetryproj(po_cfg)
         )
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index b9a2e101..62a1f059 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -149,7 +149,7 @@ def __call__(self, *,  # type:ignore[override]
         return self._make_bom(rc, rf)
 
     def _make_bom(self, root_c: Optional['Component'], rf: 'RequirementsFile') -> 'Bom':
-        from .utils.bom import make_bom
+        from .utils.cdx import make_bom
 
         bom = make_bom()
         bom.metadata.component = root_c
diff --git a/cyclonedx_py/_internal/utils/bom.py b/cyclonedx_py/_internal/utils/cdx.py
similarity index 87%
rename from cyclonedx_py/_internal/utils/bom.py
rename to cyclonedx_py/_internal/utils/cdx.py
index a6e24374..0e2b4da9 100644
--- a/cyclonedx_py/_internal/utils/bom.py
+++ b/cyclonedx_py/_internal/utils/cdx.py
@@ -16,10 +16,15 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import Any
+"""
+CycloneDX related helpers and utils.
+"""
+
+from typing import Any, Iterable
 
 from cyclonedx.model import ExternalReference, ExternalReferenceType, Tool, XsUri
 from cyclonedx.model.bom import Bom
+from cyclonedx.model.license import License, LicenseExpression
 
 from cyclonedx_py import __version__
 
@@ -65,3 +70,11 @@ def make_bom(**kwargs: Any) -> Bom:
             )
         ]))
     return bom
+
+
+def licenses_fixup(licenses: Iterable['License']) -> Iterable['License']:
+    licenses = set(licenses)
+    for license in licenses:
+        if isinstance(license, LicenseExpression):
+            return (license,)
+    return licenses
diff --git a/cyclonedx_py/_internal/utils/license_trove_classifier.py b/cyclonedx_py/_internal/utils/license_trove_classifier.py
new file mode 100644
index 00000000..45581f8f
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/license_trove_classifier.py
@@ -0,0 +1,163 @@
+# encoding: utf-8
+
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+"""
+This module is internal - it is not public API.
+All in here may have breaking change without notice.
+"""
+
+
+from typing import Optional
+
+"""
+Map of trove classifiers to SPDX license ID or SPDX license expression.
+
+Some could be mapped to SPDX expressions, in case the version was not clear - like `(EFL-1.0 OR EFL-2.0)`.
+! But this was not done yet, for uncertainties of [PEP639](https://peps.python.org/pep-0639)
+
+classifiers: https://packaging.python.org/specifications/core-metadata/#metadata-classifier
+- of list A: https://pypi.org/pypi?%3Aaction=list_classifiers
+- of lList B: https://pypi.org/classifiers/
+
+SPDX license IDs: https://spdx.org/licenses/
+
+See also: https://peps.python.org/pep-0639/#mapping-license-classifiers-to-spdx-identifiers
+"""
+__TO_SPDX_MAP = {
+
+    # region not  OSI Approved
+
+    'License :: Aladdin Free Public License (AFPL)': 'Aladdin',
+    'License :: CC0 1.0 Universal (CC0 1.0) Public Domain Dedication': 'CC0-1.0',
+    'License :: CeCILL-B Free Software License Agreement (CECILL-B)': 'CECILL-B',
+    'License :: CeCILL-C Free Software License Agreement (CECILL-C)': 'CECILL-C',
+    # 'License :: Eiffel Forum License (EFL)': which one?
+    #   -  EFL-1.0
+    #   -  EFL-2.0
+    # 'License :: Free For Educational Use': unknown to SPDX
+    # 'License :: Free For Home Use': unknown to SPDX
+    # 'License :: Free To Use But Restricted': unknown to SPDX
+    # 'License :: Free for non-commercial use': unknown to SPDX
+    # 'License :: Freely Distributable': unknown to SPDX
+    # 'License :: Freeware': unknown to SPDX
+    # 'License :: GUST Font License 1.0': unknown to SPDX,
+    # 'License :: GUST Font License 2006-09-30': unknown to SPDX
+    # 'License :: Netscape Public License (NPL)': which version?
+    #   - NPL-1.0
+    #   - NPL-1.1
+    'License :: Nokia Open Source License (NOKOS)': 'Nokia',
+    # 'License :: Other/Proprietary License': unknown to SPDX
+    # 'License :: Public Domain': unknown to SPDX
+    # 'License :: Repoze Public License': unknown to SPDX
+
+    # endregion not  OSI Approved
+
+    # region OSI Approved
+
+    # !! reminder: the following are OSI approved, sp map only to the SPDX that ar marked as so
+    # !! see the ideas and cases of https://peps.python.org/pep-0639/#mapping-license-classifiers-to-spdx-identifiers
+    # 'License :: OSI Approved :: Academic Free License (AFL)': which one?
+    #   -  AFL-1.1
+    #   -  AFL-3.0
+    # 'License :: OSI Approved :: Apache Software License': which one?
+    #    -  Apache-1.1
+    #    -  Apache-2.0
+    # 'License :: OSI Approved :: Apple Public Source License': which version?
+    #    -  APSL-1.0
+    #    -  APSL-2.0
+    # 'License :: OSI Approved :: Artistic License': which version?
+    'License :: OSI Approved :: Attribution Assurance License': 'AAL',
+    # 'License :: OSI Approved :: BSD License': which exactly?
+    'License :: OSI Approved :: Boost Software License 1.0 (BSL-1.0)': 'BSL-1.0',
+    'License :: OSI Approved :: CEA CNRS Inria Logiciel Libre License, version 2.1 (CeCILL-2.1)': 'CECILL-2.1',
+    'License :: OSI Approved :: Common Development and Distribution License 1.0 (CDDL-1.0)': 'CDDL-1.0',
+    'License :: OSI Approved :: Common Public License': 'CPL-1.0',
+    'License :: OSI Approved :: Eclipse Public License 1.0 (EPL-1.0)': 'EPL-1.0',
+    'License :: OSI Approved :: Eclipse Public License 2.0 (EPL-2.0)': 'EPL-1.0',
+    # 'License :: OSI Approved :: Eiffel Forum License': which version?
+    'License :: OSI Approved :: European Union Public Licence 1.0 (EUPL 1.0)': 'EUPL-1.0',
+    'License :: OSI Approved :: European Union Public Licence 1.1 (EUPL 1.1)': 'EUPL-1.1',
+    'License :: OSI Approved :: European Union Public Licence 1.2 (EUPL 1.2)': 'EUPL-1.2',
+    'License :: OSI Approved :: GNU Affero General Public License v3': 'AGPL-3.0-only',
+    'License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)': 'AGPL-3.0-or-later',
+    # 'License :: OSI Approved :: GNU Free Documentation License (FDL)': which version?
+    # 'License :: OSI Approved :: GNU General Public License (GPL)': which version?
+    'License :: OSI Approved :: GNU General Public License v2 (GPLv2)': 'GPL-2.0-only',
+    'License :: OSI Approved :: GNU General Public License v2 or later (GPLv2+)': 'GPL-2.0-or-later',
+    'License :: OSI Approved :: GNU General Public License v3 (GPLv3)': 'GPL-3.0-only',
+    'License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)': 'GPL-3.0-or-later',
+    # 'License :: OSI Approved :: GNU Lesser General Public License v2 (LGPLv2)': which one?
+    #  - LGPL-2.0-only
+    #  - LGPL-2.1-only
+    # 'License :: OSI Approved :: GNU Lesser General Public License v2 or later (LGPLv2+)': which one?
+    #  - LGPL-2.0-or-later
+    #  - LGPL-2.1-or-later
+    'License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)': 'LGPL-3.0-only',
+    'License :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)': 'LGPL-3.0-or-later',
+    # 'License :: OSI Approved :: GNU Library or Lesser General Public License (LGPL)': which version?
+    'License :: OSI Approved :: Historical Permission Notice and Disclaimer (HPND)': 'HPND',
+    'License :: OSI Approved :: IBM Public License': 'IPL-1.0',
+    'License :: OSI Approved :: ISC License (ISCL)': 'ISC',
+    'License :: OSI Approved :: Intel Open Source License': 'Intel',
+    # 'License :: OSI Approved :: Jabber Open Source License': unknown to SPDX
+    'License :: OSI Approved :: MIT License': 'MIT',
+    'License :: OSI Approved :: MIT No Attribution License (MIT-0)': 'MIT-0',
+    # 'License :: OSI Approved :: MITRE Collaborative Virtual Workspace License (CVW)': unknown to SPDX
+    'License :: OSI Approved :: MirOS License (MirOS)': 'MirOS',
+    'License :: OSI Approved :: Motosoto License': 'Motosoto',
+    'License :: OSI Approved :: Mozilla Public License 1.0 (MPL)': 'MPL-1.0',
+    'License :: OSI Approved :: Mozilla Public License 1.1 (MPL 1.1)': 'MPL-1.1',
+    # 'License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)': which one? MPL-XXX
+    #   - MPL-2.0
+    #   - MPL-2.0-no-copyleft-exception
+    'License :: OSI Approved :: Mulan Permissive Software License v2 (MulanPSL-2.0)': 'MulanPSL-1.0',
+    'License :: OSI Approved :: Nethack General Public License': 'NGPL',
+    'License :: OSI Approved :: Nokia Open Source License': 'Nokia',
+    'License :: OSI Approved :: Open Group Test Suite License': 'OGTSL',
+    'License :: OSI Approved :: Open Software License 3.0 (OSL-3.0)': 'OSL-3.0',
+    'License :: OSI Approved :: PostgreSQL License': 'PostgreSQL',
+    'License :: OSI Approved :: Python License (CNRI Python License)': 'CNRI-Python',
+    'License :: OSI Approved :: Python Software Foundation License': 'Python-2.0',
+    'License :: OSI Approved :: Qt Public License (QPL)': 'QPL-1.0',
+    'License :: OSI Approved :: Ricoh Source Code Public License': 'RSCPL',
+    # 'License :: OSI Approved :: SIL Open Font License 1.1 (OFL-1.1)': which one? OFL-XXX
+    #   - OFL-1.1
+    #   - OFL-1.1-no-RFN OFL-1.1-RFN
+    'License :: OSI Approved :: Sleepycat License': 'Sleepycat',
+    'License :: OSI Approved :: Sun Industry Standards Source License (SISSL)': 'SISSL',
+    'License :: OSI Approved :: Sun Public License': 'SPL-1.0',
+    'License :: OSI Approved :: The Unlicense (Unlicense)': 'Unlicense',
+    'License :: OSI Approved :: Universal Permissive License (UPL)': 'UPL-1.0',
+    'License :: OSI Approved :: University of Illinois/NCSA Open Source License': 'NCSA',
+    'License :: OSI Approved :: Vovida Software License 1.0': 'VSL-1.0',
+    'License :: OSI Approved :: W3C License': 'W3C',
+    'License :: OSI Approved :: X.Net License': 'Xnet',
+    # 'License :: OSI Approved :: Zope Public License': which one? ZPL-XXX
+    #   - ZPL-2.0
+    #   - ZPL-2.1
+    'License :: OSI Approved :: zlib/libpng License': 'Zlib',
+
+    # endregion OSI Approved
+}
+
+
+def license_trove2spdx(classifier: str) -> Optional[str]:
+    """return the SPDX id or expression for a given license trove classifier"""
+    return __TO_SPDX_MAP.get(classifier)
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index 0187bea4..735f86c7 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -16,27 +16,61 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-"""functionality related tot PEP 621
-See https://peps.python.org/pep-0621/
+"""
+Functionality related to PEP 621
+
 See https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+See https://peps.python.org/pep-0621/
 """
 
-from typing import TYPE_CHECKING, Any, Dict
+
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable
 
 if TYPE_CHECKING:
+    from cyclonedx.factory.license import LicenseFactory
     from cyclonedx.model.component import Component, ComponentType
+    from cyclonedx.model.license import License
+
+
+def classifiers2licenses(classifiers: Iterable[str], lfac: 'LicenseFactory') -> Generator['License', None, None]:
+    from .license_trove_classifier import license_trove2spdx
+    yield from map(lfac.make_from_string,
+                   # `lfac.make_with_id` could be a shortcut,
+                   # but some SPDX ID might not (yet) be known to CDX.
+                   # So better go with `lfac.make_from_string` and be safe.
+                   filter(None,
+                          map(license_trove2spdx,
+                              classifiers)))
+
+
+def pyproject2licenses(pyproject: Dict[str, Any], lfac: 'LicenseFactory') -> Generator['License', None, None]:
+    if 'classifiers' in pyproject:
+        # https://packaging.python.org/en/latest/specifications/pyproject-toml/#classifiers
+        # https://peps.python.org/pep-0621/#classifiers
+        # https://packaging.python.org/en/latest/specifications/core-metadata/#classifier-multiple-use
+        yield from classifiers2licenses(pyproject['classifiers'], lfac)
+    license = pyproject.get('license')
+    # https://packaging.python.org/en/latest/specifications/pyproject-toml/#license
+    # https://peps.python.org/pep-0621/#license
+    # https://packaging.python.org/en/latest/specifications/core-metadata/#license
+    if isinstance(license, dict) and 'text' in license:
+        yield lfac.make_from_string(license['text'])
 
 
 def pyproject2component(pyproject: Dict[str, Any], *,
                         type: 'ComponentType') -> 'Component':
+    from cyclonedx.factory.license import LicenseFactory
     from cyclonedx.model.component import Component
 
+    from .cdx import licenses_fixup
+
     project = pyproject['project']
     return Component(
         type=type,
         name=project['name'],
         version=project.get('version', None),
         description=project.get('description', None),
+        licenses=licenses_fixup(pyproject2licenses(project, LicenseFactory())),
         # TODO add more properties according to spec
     )
 
diff --git a/tests/_data/infiles/pipenv/no-deps/pyproject.toml b/tests/_data/infiles/pipenv/no-deps/pyproject.toml
index 1692cab8..501d43c7 100644
--- a/tests/_data/infiles/pipenv/no-deps/pyproject.toml
+++ b/tests/_data/infiles/pipenv/no-deps/pyproject.toml
@@ -3,7 +3,7 @@
 name = "no-deps"
 version = "0.1.0"
 description = "packages with all meta, but no deps"
-license = "Apache-2.0"
+license = {text="Apache-2.0 OR MIT"}
 readme = "README.md"
 requires-python = ">=3.8"
 
@@ -24,7 +24,12 @@ maintainers = [
 ]
 
 keywords = ["packaging", "pipenv", "test"]
-# classifiers = [] # TODO
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
 
 # dependencies = [] # TODO
 # optional-dependencies = [] # TODO
diff --git a/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
index cd1da5f7..a24063d8 100644
--- a/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
@@ -1,7 +1,7 @@
 [tool.poetry]
 ## https://python-poetry.org/docs/pyproject/
 name = "no-deps"
-license = "Apache-2.0"
+license = "Apache-2.0 OR MIT"
 version = "0.1.0"
 description = "packages with all meta, but no deps"
 authors = ["Your Name <you@example.com>", "My Name"]
@@ -14,8 +14,10 @@ repository = "https://oss.acme.org/my-project.git"
 documentation = "https://oss.acme.org/my-project/docs/"
 keywords = ["packaging", "poetry", "test"]
 classifiers = [
-  "Topic :: Software Development :: Build Tools",
-  "Topic :: Software Development :: Libraries :: Python Modules"
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
 ]
 [tool.poetry.urls]
 "Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
diff --git a/tests/_data/infiles/requirements/pyproject.toml b/tests/_data/infiles/requirements/pyproject.toml
index 7a5a66e2..ca213c81 100644
--- a/tests/_data/infiles/requirements/pyproject.toml
+++ b/tests/_data/infiles/requirements/pyproject.toml
@@ -3,7 +3,7 @@
 name = "testing-requirements-txt"
 version = "0.1.0"
 description = "some `reuqirements.txt` a root-component with all metadata"
-license = "Apache-2.0"
+license = {text="Apache-2.0 OR MIT"}
 readme = "README.md"
 requires-python = ">=3.7"
 
@@ -24,7 +24,12 @@ maintainers = [
 ]
 
 keywords = ["packaging", "pipenv", "test"]
-# classifiers = [] # TODO
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
 
 # dependencies = [] # TODO
 # optional-dependencies = [] # TODO
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin b/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin
index e4aad8d6..b1e74fb9 100644
--- a/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin
+++ b/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin
@@ -8,6 +8,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "no-deps",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin
index 88a98c86..1aa0d581 100644
--- a/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin
+++ b/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin
@@ -17,6 +17,9 @@
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <dependencies>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin
index 1ba0aca5..0e68e583 100644
--- a/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin
@@ -8,6 +8,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "no-deps",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin
index ebd0be55..bb7c9d9f 100644
--- a/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin
@@ -17,6 +17,9 @@
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <dependencies>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin
index 5387d361..c08f4eca 100644
--- a/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin
@@ -8,6 +8,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "no-deps",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin
index 453617f7..a6ae68bb 100644
--- a/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin
@@ -44,6 +44,9 @@
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <dependencies>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
index 4b36d63d..500bb907 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
@@ -43,9 +43,7 @@
       ],
       "licenses": [
         {
-          "license": {
-            "id": "Apache-2.0"
-          }
+          "expression": "Apache-2.0 OR MIT"
         }
       ],
       "name": "no-deps",
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
index 4e8a60c3..299c55a3 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
@@ -19,9 +19,7 @@
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
       <licenses>
-        <license>
-          <id>Apache-2.0</id>
-        </license>
+        <expression>Apache-2.0 OR MIT</expression>
       </licenses>
       <externalReferences>
         <reference type="documentation">
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
index 83f52fb1..dd9dbc77 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
@@ -43,9 +43,7 @@
       ],
       "licenses": [
         {
-          "license": {
-            "id": "Apache-2.0"
-          }
+          "expression": "Apache-2.0 OR MIT"
         }
       ],
       "name": "no-deps",
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
index efc784d2..1e6140a2 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
@@ -19,9 +19,7 @@
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
       <licenses>
-        <license>
-          <id>Apache-2.0</id>
-        </license>
+        <expression>Apache-2.0 OR MIT</expression>
       </licenses>
       <externalReferences>
         <reference type="documentation">
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
index 8f8d8dcc..88cf4534 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
@@ -43,9 +43,7 @@
       ],
       "licenses": [
         {
-          "license": {
-            "id": "Apache-2.0"
-          }
+          "expression": "Apache-2.0 OR MIT"
         }
       ],
       "name": "no-deps",
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
index 29da7069..5f60a84a 100644
--- a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
@@ -46,9 +46,7 @@
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
       <licenses>
-        <license>
-          <id>Apache-2.0</id>
-        </license>
+        <expression>Apache-2.0 OR MIT</expression>
       </licenses>
       <externalReferences>
         <reference type="documentation">
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
index dac5f298..c29e6eb5 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
@@ -46,6 +46,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
index d6560072..139772dd 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
index 93e9baca..a909ee08 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
@@ -56,6 +56,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
index 718c3961..550ede05 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
index 59f8b71b..636d3ffc 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
@@ -56,6 +56,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
index c9416bb4..63850b70 100644
--- a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
index 29aefa1e..b525083c 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
@@ -112,6 +112,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
index 63d4263b..9fe8a9c2 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
index 246dec51..1fa457f5 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
@@ -118,6 +118,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
index 68e99bf1..403c5db8 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
index cfbf1936..dd07799b 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
@@ -113,6 +113,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
index a8f2f7fe..bdf039c6 100644
--- a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
index dac5f298..c29e6eb5 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
@@ -46,6 +46,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
index d6560072..139772dd 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
index 93e9baca..a909ee08 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
@@ -56,6 +56,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
index 718c3961..550ede05 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
index 59f8b71b..636d3ffc 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
@@ -56,6 +56,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
index c9416bb4..63850b70 100644
--- a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
index a46dd9a4..176a0215 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
@@ -38,6 +38,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
index 312d5b7e..a19d7074 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
index 046c7822..d8e0373d 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
@@ -38,6 +38,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
index 12331dfe..fd12d8ff 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
index eced0504..6bed45d8 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
@@ -38,6 +38,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
index 116f18ff..0d3cdbaa 100644
--- a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
index 0906755b..19f78edb 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
@@ -64,6 +64,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
index 33c9c20b..2d0792bd 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
index 81288fbc..64ec9b6b 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
@@ -64,6 +64,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
index 0ce54932..4c1d765f 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
index 6bbd7da9..ccd57626 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
@@ -61,6 +61,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
index ed5c50ac..c9d606ed 100644
--- a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
index fd6b9f21..a2594e2c 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
@@ -100,6 +100,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
index b38b667b..473bf115 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
index 547346e5..03e76120 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
@@ -100,6 +100,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
index 878a2b92..c1c509aa 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
index ab88420d..cd8fc1eb 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
@@ -100,6 +100,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
index 2c05c0e4..59b2551c 100644
--- a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
index 8127d0d4..660f6aa2 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
@@ -28,6 +28,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
index 2c1190d3..ee6f0427 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
index b3cc1c47..753cbf69 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
@@ -38,6 +38,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
index 2e7d5a42..b89cd677 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
index 40a15a40..05c5b4c5 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
@@ -38,6 +38,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
index e9cf4c80..b38778b9 100644
--- a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
index 1ef1d29a..aa096cbe 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
@@ -100,6 +100,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
index cdd2b1fb..26192663 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
index 7a449172..2d083671 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
@@ -140,6 +140,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
index ba564a7d..e6c297d2 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
index a71c99f1..392da2f5 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
@@ -139,6 +139,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
index bc83ee13..14a54e8d 100644
--- a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
index 65d94371..21c3c538 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
@@ -135,6 +135,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
index edc4c890..0c0972ec 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
index 0ee82def..64ecb03e 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
@@ -135,6 +135,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
index 72b21c59..0a00b1da 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
index eac344c0..240879c8 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
@@ -129,6 +129,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
index 9c33a723..7974354e 100644
--- a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
index f5e018f5..c34b6a5c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
@@ -64,6 +64,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
index 0d80e3bb..5e3f61a8 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
index 28da3c9a..8a88058c 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
@@ -64,6 +64,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
index 4348e831..ee8ccc80 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
@@ -17,6 +17,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
index d8f43d7c..3edd3f6a 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
@@ -61,6 +61,11 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
       "name": "testing-requirements-txt",
       "type": "application",
       "version": "0.1.0"
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
index b7c9ddd7..83893d01 100644
--- a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
@@ -44,6 +44,9 @@
       <name>testing-requirements-txt</name>
       <version>0.1.0</version>
       <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
     </component>
   </metadata>
   <components>
diff --git a/tests/functional/__init__.py b/tests/functional/__init__.py
new file mode 100644
index 00000000..c2926fb2
--- /dev/null
+++ b/tests/functional/__init__.py
@@ -0,0 +1,16 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
diff --git a/tests/functional/test_license_trove_classifier.py b/tests/functional/test_license_trove_classifier.py
new file mode 100644
index 00000000..9b554575
--- /dev/null
+++ b/tests/functional/test_license_trove_classifier.py
@@ -0,0 +1,32 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from unittest import TestCase
+
+from cyclonedx.spdx import is_supported_id
+from ddt import ddt, named_data
+
+from cyclonedx_py._internal.utils.license_trove_classifier import __TO_SPDX_MAP as TO_SPDX_MAP
+
+
+@ddt
+class TestLicenseTroveClassifier(TestCase):
+
+    @named_data(*TO_SPDX_MAP.items())
+    def test_map_is_known_id(self, mapped: str) -> None:
+        self.assertTrue(is_supported_id(mapped))

From b2c3848f0157ba398dd8c3d48dafd2961199f316 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 21 Dec 2023 03:13:11 +0100
Subject: [PATCH 144/155] tests

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tests/integration/test_cli.py | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 tests/integration/test_cli.py

diff --git a/tests/integration/test_cli.py b/tests/integration/test_cli.py
new file mode 100644
index 00000000..410bebb0
--- /dev/null
+++ b/tests/integration/test_cli.py
@@ -0,0 +1,35 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from subprocess import run  # nosec:B404
+from sys import executable
+from unittest import TestCase
+
+from cyclonedx_py import __version__
+
+
+class TestPipenv(TestCase):
+
+    def test_call_as_module(self) -> None:
+        # show that this thing is callable as a module
+        # show that the version is the one expected
+        res = run(  # nosec:B603
+            (executable, '-m', 'cyclonedx_py', '--version'),
+            capture_output=True, encoding='utf8', shell=False)
+        self.assertEqual(0, res.returncode, '\n'.join((res.stdout, res.stderr)))
+        self.assertIn(__version__, res.stdout)

From 144d0e52319becbd8b5b265cb0a4047ae29064a8 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 21 Dec 2023 13:09:30 +0100
Subject: [PATCH 145/155] feat: support CDX1.5 (#631)

* upgrade cyclonedx-python-lib v6

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

* feat: default to cdx 1.5

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py                 |    2 +-
 pyproject.toml                                |    3 +-
 .../pipenv/category-deps_1.5.json.bin         |   63 +
 .../pipenv/category-deps_1.5.xml.bin          |   73 +
 .../pipenv/default-and-dev_1.5.json.bin       |   96 +
 .../pipenv/default-and-dev_1.5.xml.bin        |   92 +
 .../pipenv/editable-self_1.5.json.bin         |   34 +
 .../pipenv/editable-self_1.5.xml.bin          |   55 +
 .../_data/snapshots/pipenv/local_1.5.json.bin |  105 +
 .../_data/snapshots/pipenv/local_1.5.xml.bin  |   99 +
 .../snapshots/pipenv/no-deps_1.5.json.bin     |   33 +
 .../snapshots/pipenv/no-deps_1.5.xml.bin      |   55 +
 .../pipenv/private-packages_1.5.json.bin      |  129 +
 .../pipenv/private-packages_1.5.xml.bin       |  111 +
 .../pypi-mirror_private-packages_1.5.json.bin |  119 +
 .../pypi-mirror_private-packages_1.5.xml.bin  |  105 +
 ...some-categories_category-deps_1.5.json.bin |  288 ++
 .../some-categories_category-deps_1.5.xml.bin |  201 ++
 .../with-dev_default-and-dev_1.5.json.bin     |  251 ++
 .../with-dev_default-and-dev_1.5.xml.bin      |  181 +
 .../snapshots/pipenv/with-extras_1.5.json.bin | 1615 +++++++++
 .../snapshots/pipenv/with-extras_1.5.xml.bin  |  719 ++++
 .../snapshots/pipenv/with-urls_1.5.json.bin   |  569 +++
 .../snapshots/pipenv/with-urls_1.5.xml.bin    |  255 ++
 .../poetry/group-deps-lock11-1.5.json.bin     |  337 ++
 .../poetry/group-deps-lock11-1.5.xml.bin      |  249 ++
 .../poetry/group-deps-lock20-1.5.json.bin     |  309 ++
 .../poetry/group-deps-lock20-1.5.xml.bin      |  236 ++
 .../poetry/local-lock10-1.5.json.bin          |   93 +
 .../snapshots/poetry/local-lock10-1.5.xml.bin |   94 +
 .../poetry/local-lock11-1.5.json.bin          |  117 +
 .../snapshots/poetry/local-lock11-1.5.xml.bin |  110 +
 .../poetry/local-lock20-1.5.json.bin          |  117 +
 .../snapshots/poetry/local-lock20-1.5.xml.bin |  110 +
 .../poetry/main-and-dev-lock10-1.5.json.bin   |  261 ++
 .../poetry/main-and-dev-lock10-1.5.xml.bin    |  200 ++
 .../poetry/main-and-dev-lock11-1.5.json.bin   |  333 ++
 .../poetry/main-and-dev-lock11-1.5.xml.bin    |  248 ++
 .../poetry/main-and-dev-lock20-1.5.json.bin   |  309 ++
 .../poetry/main-and-dev-lock20-1.5.xml.bin    |  236 ++
 .../poetry/no-deps-lock20-1.5.json.bin        |   66 +
 .../poetry/no-deps-lock20-1.5.xml.bin         |   82 +
 .../poetry/no-dev-lock11-1.5.json.bin         |   75 +
 .../poetry/no-dev-lock11-1.5.xml.bin          |   83 +
 .../poetry/no-dev-lock20-1.5.json.bin         |   75 +
 .../poetry/no-dev-lock20-1.5.xml.bin          |   83 +
 .../poetry/only-groups-lock11-1.5.json.bin    |  253 ++
 .../poetry/only-groups-lock11-1.5.xml.bin     |  195 +
 .../poetry/only-groups-lock20-1.5.json.bin    |  225 ++
 .../poetry/only-groups-lock20-1.5.xml.bin     |  182 +
 .../private-packges-lock10-1.5.json.bin       |  117 +
 .../poetry/private-packges-lock10-1.5.xml.bin |  110 +
 .../private-packges-lock11-1.5.json.bin       | 1172 ++++++
 .../poetry/private-packges-lock11-1.5.xml.bin |  783 ++++
 .../private-packges-lock20-1.5.json.bin       | 1136 ++++++
 .../poetry/private-packges-lock20-1.5.xml.bin |  765 ++++
 .../regression-issue611-lock20-1.5.json.bin   |   75 +
 .../regression-issue611-lock20-1.5.xml.bin    |   83 +
 .../poetry/some-extras-lock10-1.5.json.bin    |  186 +
 .../poetry/some-extras-lock10-1.5.xml.bin     |  148 +
 .../poetry/some-extras-lock11-1.5.json.bin    | 2133 +++++++++++
 .../poetry/some-extras-lock11-1.5.xml.bin     | 1397 ++++++++
 .../poetry/some-extras-lock20-1.5.json.bin    | 3179 +++++++++++++++++
 .../poetry/some-extras-lock20-1.5.xml.bin     | 2092 +++++++++++
 .../poetry/some-groups-lock11-1.5.json.bin    |  341 ++
 .../poetry/some-groups-lock11-1.5.xml.bin     |  250 ++
 .../poetry/some-groups-lock20-1.5.json.bin    |  309 ++
 .../poetry/some-groups-lock20-1.5.xml.bin     |  236 ++
 .../poetry/with-extras-lock10-1.5.json.bin    |   29 +
 .../poetry/with-extras-lock10-1.5.xml.bin     |   53 +
 .../poetry/with-extras-lock11-1.5.json.bin    |   29 +
 .../poetry/with-extras-lock11-1.5.xml.bin     |   53 +
 .../poetry/with-extras-lock20-1.5.json.bin    |   29 +
 .../poetry/with-extras-lock20-1.5.xml.bin     |   53 +
 .../poetry/with-urls-lock10-1.5.json.bin      |  146 +
 .../poetry/with-urls-lock10-1.5.xml.bin       |  130 +
 .../poetry/with-urls-lock11-1.5.json.bin      |  154 +
 .../poetry/with-urls-lock11-1.5.xml.bin       |  132 +
 .../poetry/with-urls-lock20-1.5.json.bin      |  166 +
 .../poetry/with-urls-lock20-1.5.xml.bin       |  138 +
 .../requirements/frozen.txt-1.5.json-file.bin |   81 +
 .../frozen.txt-1.5.json-stream.bin            |   66 +
 .../requirements/frozen.txt-1.5.xml-file.bin  |   87 +
 .../frozen.txt-1.5.xml-stream.bin             |   78 +
 .../requirements/local.txt-1.5.json-file.bin  |  138 +
 .../local.txt-1.5.json-stream.bin             |  123 +
 .../requirements/local.txt-1.5.xml-file.bin   |  127 +
 .../requirements/local.txt-1.5.xml-stream.bin |  118 +
 .../requirements/nested.txt-1.5.json-file.bin |   81 +
 .../nested.txt-1.5.json-stream.bin            |   16 +
 .../requirements/nested.txt-1.5.xml-file.bin  |   87 +
 .../nested.txt-1.5.xml-stream.bin             |   44 +
 .../private-packages.txt-1.5.json-file.bin    |   63 +
 .../private-packages.txt-1.5.json-stream.bin  |   48 +
 .../private-packages.txt-1.5.xml-file.bin     |   78 +
 .../private-packages.txt-1.5.xml-stream.bin   |   69 +
 ...ssue448.cp1252.txt.bin-1.5.json-stream.bin |   71 +
 ...issue448.cp1252.txt.bin-1.5.xml-stream.bin |   84 +
 .../with-comments.txt-1.5.json-file.bin       |  125 +
 .../with-comments.txt-1.5.json-stream.bin     |  110 +
 .../with-comments.txt-1.5.xml-file.bin        |  122 +
 .../with-comments.txt-1.5.xml-stream.bin      |  113 +
 .../with-extras.txt-1.5.json-file.bin         |   63 +
 .../with-extras.txt-1.5.json-stream.bin       |   48 +
 .../with-extras.txt-1.5.xml-file.bin          |   74 +
 .../with-extras.txt-1.5.xml-stream.bin        |   65 +
 .../with-hashes.txt-1.5.json-file.bin         |  164 +
 .../with-hashes.txt-1.5.json-stream.bin       |  149 +
 .../with-hashes.txt-1.5.xml-file.bin          |  137 +
 .../with-hashes.txt-1.5.xml-stream.bin        |  128 +
 .../with-urls.txt-1.5.json-file.bin           |  154 +
 .../with-urls.txt-1.5.json-stream.bin         |  139 +
 .../with-urls.txt-1.5.xml-file.bin            |  141 +
 .../with-urls.txt-1.5.xml-stream.bin          |  132 +
 ...hout-pinned-versions.txt-1.5.json-file.bin |   86 +
 ...ut-pinned-versions.txt-1.5.json-stream.bin |   71 +
 ...thout-pinned-versions.txt-1.5.xml-file.bin |   93 +
 ...out-pinned-versions.txt-1.5.xml-stream.bin |   84 +
 118 files changed, 29209 insertions(+), 3 deletions(-)
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/category-deps_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/default-and-dev_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/editable-self_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/local_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/no-deps_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/private-packages_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-extras_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.5.json.bin
 create mode 100644 tests/_data/snapshots/pipenv/with-urls_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/group-deps-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock10-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/local-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-deps-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/no-dev-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/only-groups-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock10-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/private-packges-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock10-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-extras-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/some-groups-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock10-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-extras-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock10-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock11-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.5.json.bin
 create mode 100644 tests/_data/snapshots/poetry/with-urls-lock20-1.5.xml.bin
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/frozen.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/local.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/nested.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-file.bin
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-stream.bin
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-file.bin
 create mode 100644 tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-stream.bin

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index e54cedbf..b38a9f18 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -82,7 +82,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                         dest='schema_version',
                         choices=SchemaVersion,
                         type=SchemaVersion.from_version,
-                        default=SchemaVersion.V1_4.to_version())
+                        default=SchemaVersion.V1_5.to_version())
         op.add_argument('--of', '--output-format',
                         metavar='FORMAT',
                         help=f'The output format for your SBOM {choices4enum(OutputFormat)} (default: %(default)s)',
diff --git a/pyproject.toml b/pyproject.toml
index 381d04a9..d7888e2a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -48,10 +48,9 @@ classifiers = [
 [tool.poetry.dependencies]
 python = "^3.8"
 # ATTENTION: keep `deps.lowest.r` file in sync
-cyclonedx-python-lib = { version = "^5.1.1", extras = ['validation'] }
+cyclonedx-python-lib = { version = "^6.0.0", extras = ['validation'] }
 packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
-setuptools = ">= 47.0.0"
 tomli = { version = "^2.0.1", python = "<3.11" }
 chardet = "^5.1"
 
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/category-deps_1.5.json.bin
new file mode 100644
index 00000000..b9dfb20f
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.5.json.bin
@@ -0,0 +1,63 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "dependencies organized in groups",
+      "name": "category-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/category-deps_1.5.xml.bin
new file mode 100644
index 00000000..9c800b74
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/category-deps_1.5.xml.bin
@@ -0,0 +1,73 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>category-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.5.json.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.5.json.bin
new file mode 100644
index 00000000..99ceb363
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.5.json.bin
@@ -0,0 +1,96 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "default and dev depenndencies",
+      "name": "default-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.5.xml.bin b/tests/_data/snapshots/pipenv/default-and-dev_1.5.xml.bin
new file mode 100644
index 00000000..869c6151
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/default-and-dev_1.5.xml.bin
@@ -0,0 +1,92 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>default-and-dev</name>
+      <version>0.1.0</version>
+      <description>default and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="root-component"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.5.json.bin b/tests/_data/snapshots/pipenv/editable-self_1.5.json.bin
new file mode 100644
index 00000000..d582f6bc
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.5.json.bin
@@ -0,0 +1,34 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.5.xml.bin b/tests/_data/snapshots/pipenv/editable-self_1.5.xml.bin
new file mode 100644
index 00000000..ea1d4c82
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/editable-self_1.5.xml.bin
@@ -0,0 +1,55 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/local_1.5.json.bin b/tests/_data/snapshots/pipenv/local_1.5.json.bin
new file mode 100644
index 00000000..f979f8f6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.5.json.bin
@@ -0,0 +1,105 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library"
+    },
+    {
+      "bom-ref": "package-b",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
+            }
+          ],
+          "type": "distribution",
+          "url": "file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library"
+    },
+    {
+      "bom-ref": "package-c",
+      "externalReferences": [
+        {
+          "comment": "from path",
+          "type": "distribution",
+          "url": "../../_helpers/local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a"
+    },
+    {
+      "ref": "package-b"
+    },
+    {
+      "ref": "package-c"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/local_1.5.xml.bin b/tests/_data/snapshots/pipenv/local_1.5.xml.bin
new file mode 100644
index 00000000..5152904f
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/local_1.5.xml.bin
@@ -0,0 +1,99 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a">
+      <name>package-a</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b">
+      <name>package-b</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file:../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c">
+      <name>package-c</name>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../_helpers/local_pckages/c</url>
+          <comment>from path</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a"/>
+    <dependency ref="package-b"/>
+    <dependency ref="package-c"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/no-deps_1.5.json.bin
new file mode 100644
index 00000000..a25741c6
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.5.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/no-deps_1.5.xml.bin
new file mode 100644
index 00000000..461db07e
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/no-deps_1.5.xml.bin
@@ -0,0 +1,55 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.5.json.bin b/tests/_data/snapshots/pipenv/private-packages_1.5.json.bin
new file mode 100644
index 00000000..0b545897
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.5.json.bin
@@ -0,0 +1,129 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.2",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.5.xml.bin b/tests/_data/snapshots/pipenv/private-packages_1.5.xml.bin
new file mode 100644
index 00000000..5833d110
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/private-packages_1.5.xml.bin
@@ -0,0 +1,111 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b</hash>
+            <hash alg="SHA-256">f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin
new file mode 100644
index 00000000..8da4444d
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin
@@ -0,0 +1,119 @@
+{
+  "components": [
+    {
+      "bom-ref": "numpy==1.26.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/numpy/"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple",
+      "type": "library",
+      "version": "1.26.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypy-mirror.testing.acme.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pysrc1.acme.org",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "numpy==1.26.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin
new file mode 100644
index 00000000..00092843
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin
@@ -0,0 +1,105 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="numpy==1.26.2">
+      <name>numpy</name>
+      <version>1.26.2</version>
+      <purl>pkg:pypi/numpy@1.26.2?repository_url=https://pypy-mirror.testing.acme.org/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/numpy/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">96ca5482c3dbdd051bcd1fce8034603d6ebfc125a7bd59f55b40d8f5d246832b</hash>
+            <hash alg="SHA-256">f65738447676ab5777f11e6bbbdb8ce11b785e105f690bc45966574816b6d3ea</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypy-mirror.testing.acme.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/toml/</url>
+          <comment>from explicit index: pysrc1.acme.org</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="numpy==1.26.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin
new file mode 100644
index 00000000..daf7cd3b
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin
@@ -0,0 +1,288 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "categoryB"
+        },
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "ddt==1.7.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.7.0",
+      "type": "library",
+      "version": "1.7.0"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "ddt==1.7.0"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin
new file mode 100644
index 00000000..bb227a0f
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin
@@ -0,0 +1,201 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">categoryB</property>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt==1.7.0">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">groupA</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="ddt==1.7.0"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin
new file mode 100644
index 00000000..fa10aaf8
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin
@@ -0,0 +1,251 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml==0.10.2",
+      "externalReferences": [
+        {
+          "comment": "from explicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "develop"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "colorama==0.4.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "toml==0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin
new file mode 100644
index 00000000..1380989d
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin
@@ -0,0 +1,181 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama==0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/</url>
+          <comment>from explicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">develop</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="colorama==0.4.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="toml==0.10.2"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.5.json.bin b/tests/_data/snapshots/pipenv/with-extras_1.5.json.bin
new file mode 100644
index 00000000..1587783b
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.5.json.bin
@@ -0,0 +1,1615 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/"
+        }
+      ],
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean.py/"
+        }
+      ],
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==5.1.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/"
+        }
+      ],
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/"
+        }
+      ],
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/"
+        }
+      ],
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f614fd46d8d61258610998997743ec5492a648b33cf478c1ddc23ed4598a5fa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ed6231f0429ecf966f5bc8dfef245998220549cbbcf140f913b7464c52c3b6b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/"
+        }
+      ],
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9472fc4fea474cd74bea4a2b190daeccb5a9e4db2ea80efcf7a1b582fc9a81b8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e74ba7c0a65e8cb49dc26837d6cfe576557084a8b423ed16a420984228104f93"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1a7dc2bb2d09cdc983d072e4f9adc787e107e09def84cbb3919baaaf4f8e6fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "599928edd995c43fc335e0af342076144dc71cb858afa1ed9c1c30c4e81794f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/"
+        }
+      ],
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.3",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/"
+        }
+      ],
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python==0.11.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable==0.15.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/"
+        }
+      ],
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.31.1",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81a1471c68c9d5e3831c30ad1dd9815c45b558e596653db751a2bfdd17b3b9ec"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c19c4d006f1757e3dd75c4f784d38f8698d87b649c54f9ace14e5e8c9667c01d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/"
+        }
+      ],
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.31.1",
+      "type": "library",
+      "version": "0.31.1"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/"
+        }
+      ],
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.13.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06d218e4464d31301e943b65b2c6919318ea6f69703a351961e1baaf60347276"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "12ecf89bd54734c3c2c79898ae2021dca42750c7bcfb67f8fb3315453738ac8f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "15253fff410873ebf3cfba1cc686a37711efcd9b8cb30ea21bb14a973e393f60"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "188435794405c7f0573311747c85a96b63c954a5f2111b1df8018979eca0f2f0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1ceebd0ae4f3e9b2b6b553b51971921853ae4eebf3f54086be0565d59291e53d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "244e173bb6d8f3b2f0c4d7370a1aa341f35da3e57ffd1798e5b2917b91731fd3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25b28b3d33ec0a78e944aaaed7e5e2a94ac811bcd68b557ca48a0c30f87497d2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25ea41635d22b2eb6326f58e608550e55d01df51b8a580ea7e75396bafbb28e9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "29d311e44dd16d2434d5506d57ef4d7036544fc3c25c14b6992ef41f541b10fb"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2a1472956c5bcc49fb0252b965239bffe801acc9394f8b7c1014ae9258e4572b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2a7bef6977043673750a88da064fd513f89505111014b4e00fbdd13329cd4e9a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2ac26f50736324beb0282c819668328d53fc38543fa61eeea2c32ea8ea6eab8d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2e72f750048b32d39e87fc85c225c50b2a6715034848dbb196bf3348aa761fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "31e220a040b89a01505128c2f8a59ee74732f666439a03e65ccbf3824cdddae7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "35f53c76a712e323c779ca39b9a81b13f219a8e3bc15f106ed1e1462d56fcfe9"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "38d4f822ee2f338febcc85aaa2547eb5ba31ba6ff68d10b8ec988929d23bb6b4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "38f9bf2ad754b4a45b8210a6c732fe876b8a14e14d5992a8c4b7c1ef78740f53"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3a44c8440183b43167fd1a0819e8356692bf5db1ad14ce140dbd40a1485f2dea"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3ab96754d23372009638a402a1ed12a27711598dd49d8316a22597141962fe66"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3c55d7f2d817183d43220738270efd3ce4e7a7b7cbdaefa6d551ed3d6ed89190"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "46e1ed994a0920f350a4547a38471217eb86f57377e9314fbaaa329b71b7dfe3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4a5375c5fff13f209527cd886dc75394f040c7d1ecad0a2cb0627f13ebe78a12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c2d26aa03d877c9730bf005621c92da263523a1e99247590abbbe252ccb7824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4c4e314d36d4f31236a545696a480aa04ea170a0b021e9a59ab1ed94d4c3ef27"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d0c10d803549427f427085ed7aebc39832f6e818a011dcd8785e9c6a1ba9b3e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4dcc5ee1d0275cb78d443fdebd0241e58772a354a6d518b1d7af1580bbd2c4e8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "51967a67ea0d7b9b5cd86036878e2d82c0b6183616961c26d825b8c994d4f2c8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "530190eb0cd778363bbb7596612ded0bb9fef662daa98e9d92a0419ab27ae914"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5379e49d7e80dca9811b36894493d1c1ecb4c57de05c36f5d0dd09982af20211"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5493569f861fb7b05af6d048d00d773c6162415ae521b7010197c98810a14cab"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5a4c1058cdae6237d97af272b326e5f78ee7ee3bbffa6b24b09db4d828810468"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5d75d6d220d55cdced2f32cc22f599475dbe881229aeddba6c79c2e9df35a2b3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5d97e9ae94fb96df1ee3cb09ca376c34e8a122f36927230f4c8a97f469994bff"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5feae2f9aa7270e2c071f488fab256d768e88e01b958f123a690f1cc3061a09c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "603d5868f7419081d616dab7ac3cfa285296735e7350f7b1e4f548f6f953ee7d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "61d42d2b08430854485135504f672c14d4fc644dd243a9c17e7c4e0faf5ed07e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "61dbc1e01dc0c5875da2f7ae36d6e918dc1b8d2ce04e871793976594aad8a57a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65cfed9c807c27dee76407e8bb29e6f4e391e436774bcc769a037ff25ad8646e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "67a429520e97621a763cf9b3ba27574779c4e96e49a27ff8a1aa99ee70beb28a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6aadae3042f8e6db3376d9e91f194c606c9a45273c170621d46128f35aef7cd0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ba8858933f0c1a979781272a5f65646fca8c18c93c99c6ddb5513ad96fa54b1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6bc568b05e02cd612be53900c88aaa55012e744930ba2eeb56279db4c6676eb3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "729408136ef8d45a28ee9a7411917c9e3459cf266c7e23c2f7d4bb8ef9e0da42"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "751758d9dd04d548ec679224cc00e3591f5ebf1ff159ed0d4aba6a0746352452"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "76d59d4d451ba77f08cb4cd9268dec07be5bc65f73666302dbb5061989b17198"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "79bf58c08f0756adba691d480b5a20e4ad23f33e1ae121584cf3a21717c36dfa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7de12b69d95072394998c622cfd7e8cea8f560db5fca6a62a148f902a1029f8b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7f55cd9cf1564b7b03f238e4c017ca4794c05b01a783e9291065cb2858d86ce4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "80e5acb81cb49fd9f2d5c08f8b74ffff14ee73b10ca88297ab4619e946bcb1e1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "87a90f5545fd61f6964e65eebde4dc3fa8660bb7d87adb01d4cf17e0a2b484ad"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "881df98f0a8404d32b6de0fd33e91c1b90ed1516a80d4d6dc69d414b8850474c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8a776a29b77fe0cc28fedfd87277b0d0f7aa930174b7e504d764e0b43a05f381"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8c2a61c0e4811012b0ba9f6cdcb4437865df5d29eab5d6018ba13cee1c3064a0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8fa6bd071ec6d90f6e7baa66ae25820d57a8ab1b0a3c6d3edf1834d4b26fafa2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96f2975fb14f39c5fe75203f33dd3010fe37d1c4e33177feef1107b5ced750e3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96fb0899bb2ab353f42e5374c8f0789f54e0a94ef2f02b9ac7149c56622eaf31"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "97163a1ab265a1073a6372eca9f4eeb9f8c6327457a0b22ddfc4a17dcd613e74"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9c95a1a290f9acf7a8f2ebbdd183e99215d491beea52d61aa2a7a7d2c618ddc6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9d94d78418203904730585efa71002286ac4c8ac0689d0eb61e3c465f9e608ff"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a6ba2cb7d676e9415b9e9ac7e2aae401dc1b1e666943d1f7bc66223d3d73467b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aa0379c1935c44053c98826bc99ac95f3a5355675a297ac9ce0dfad0ce2d50ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ac96d67b37f28e4b6ecf507c3405f52a40658c0a806dffde624a8fcb0314d5fd"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ade2ccb937060c299ab0dfb2dea3d2ddf7e098ed63ee3d651ebfc2c8d1e8632a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aefbdc934115d2f9278f153952003ac52cd2650e7313750390b334518c589568"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b07501b720cf060c5856f7b5626e75b8e353b5f98b9b354a21eb4bfa47e421b1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b5267feb19070bef34b8dea27e2b504ebd9d31748e3ecacb3a4101da6fcb255c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b5f6328e8e2ae8238fc767703ab7b95785521c42bb2b8790984e3477d7fa71ad"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b8996ffb60c69f677245f5abdbcc623e9442bcc91ed81b6cd6187129ad1fa3e7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b981a370f8f41c4024c170b42fbe9e691ae2dbc19d1d99151a69e2c84a0d194d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b9d121be0217787a7d59a5c6195b0842d3f701007333426e5154bf72346aa658"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bcef4f2d3dc603150421de85c916da19471f24d838c3c62a4f04c1eb511642c1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bed0252c85e21cf73d2d033643c945b460d6a02fc4a7d644e3b2d6f5f2956c64"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bfdfbe6a36bc3059fff845d64c42f2644cf875c65f5005db54f90cdfdf1df815"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c0095b8aa3e432e32d372e9a7737e65b58d5ed23b9620fea7cb81f17672f1fa1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c1f41d32a2ddc5a94df4b829b395916a4b7f103350fa76ba6de625fcb9e773ac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c45008ca79bad237cbc03c72bc5205e8c6f66403773929b1b50f7d84ef9e4d07"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c82bbf7e03748417c3a88c1b0b291288ce3e4887a795a3addaa7a1cfd9e7153e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c918621ee0a3d1fe61c313f2489464f2ae3d13633e60f520a8002a5e910982ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d204957169f0b3511fb95395a9da7d4490fb361763a9f8b32b345a7fe119cb45"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d329896c40d9e1e5c7715c98529e4a188a1f2df51212fd65102b32465612b5dc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d3a61e928feddc458a55110f42f626a2a20bea942ccedb6fb4cee70b4830ed41"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d48db29bd47814671afdd76c7652aefacc25cf96aad6daefa82d738ee87461e2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d5593855b5b2b73dd8413c3fdfa5d95b99d657658f947ba2c4318591e745d083"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d79c159adea0f1f4617f54aa156568ac69968f9ef4d1e5fefffc0a180830308e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "db09b98c7540df69d4b47218da3fbd7cb466db0fb932e971c321f1c76f155266"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ddf23960cb42b69bce13045d5bc66f18c7d53774c66c13f24cf1b9c144ba3141"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e06cfea0ece444571d24c18ed465bc93afb8c8d8d74422eb7026662f3d3f779b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e7c564c58cf8f248fe859a4f0fe501b050663f3d7fbc342172f259124fb59933"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e86593bf8637659e6a6ed58854b6c87ec4e9e45ee8a4adfd936831cef55c2d21"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eaffbd8814bb1b5dc3ea156a4c5928081ba50419f9175f4fc95269e040eff8f0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ee353bb51f648924926ed05e0122b6a0b1ae709396a80eb583449d5d477fcdf7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ee6faebb265e28920a6f23a7d4c362414b3f4bb30607141d718b991669e49ddc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "efe093acc43e869348f6f2224df7f452eab63a2c60a6c6cd6b50fd35c4e075ba"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f03a1b3a4c03e3e0161642ac5367f08479ab29972ea0ffcd4fa18f729cd2be0a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f0d320e70b6b2300ff6029e234e79fe44e9dbbfc7b98597ba28e054bd6606a57"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f252dfb4852a527987a9156cbcae3022a30f86c9d26f4f17b8c967d7580d65d2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f5f4424cb87a20b016bfdc157ff48757b89d2cc426256961643d443c6c277007"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f8eae66a1304de7368932b42d801c67969fd090ddb1a7a24f27b435ed4bed68f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fdb82eb60d31b0c033a8e8ee9f3fc7dfbaa042211131c29da29aea8531b4f18f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/"
+        }
+      ],
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.13.2",
+      "type": "library",
+      "version": "0.13.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/"
+        }
+      ],
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/"
+        }
+      ],
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/"
+        }
+      ],
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "ref": "cyclonedx-python-lib==5.1.1"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.3"
+    },
+    {
+      "ref": "packageurl-python==0.11.2"
+    },
+    {
+      "ref": "py-serializable==0.15.0"
+    },
+    {
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "ref": "referencing==0.31.1"
+    },
+    {
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.13.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.5.xml.bin b/tests/_data/snapshots/pipenv/with-extras_1.5.xml.bin
new file mode 100644
index 00000000..adc09229
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-extras_1.5.xml.bin
@@ -0,0 +1,719 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean.py/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca</hash>
+            <hash alg="SHA-256">c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">4f614fd46d8d61258610998997743ec5492a648b33cf478c1ddc23ed4598a5fa</hash>
+            <hash alg="SHA-256">ed6231f0429ecf966f5bc8dfef245998220549cbbcf140f913b7464c52c3b6b3</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+        <property name="cdx:python:package:extra">format</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9472fc4fea474cd74bea4a2b190daeccb5a9e4db2ea80efcf7a1b582fc9a81b8</hash>
+            <hash alg="SHA-256">e74ba7c0a65e8cb49dc26837d6cfe576557084a8b423ed16a420984228104f93</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1a7dc2bb2d09cdc983d072e4f9adc787e107e09def84cbb3919baaaf4f8e6fa1</hash>
+            <hash alg="SHA-256">599928edd995c43fc335e0af342076144dc71cb858afa1ed9c1c30c4e81794f5</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing==0.31.1">
+      <name>referencing</name>
+      <version>0.31.1</version>
+      <purl>pkg:pypi/referencing@0.31.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">81a1471c68c9d5e3831c30ad1dd9815c45b558e596653db751a2bfdd17b3b9ec</hash>
+            <hash alg="SHA-256">c19c4d006f1757e3dd75c4f784d38f8698d87b649c54f9ace14e5e8c9667c01d</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.13.2">
+      <name>rpds-py</name>
+      <version>0.13.2</version>
+      <purl>pkg:pypi/rpds-py@0.13.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">06d218e4464d31301e943b65b2c6919318ea6f69703a351961e1baaf60347276</hash>
+            <hash alg="SHA-256">12ecf89bd54734c3c2c79898ae2021dca42750c7bcfb67f8fb3315453738ac8f</hash>
+            <hash alg="SHA-256">15253fff410873ebf3cfba1cc686a37711efcd9b8cb30ea21bb14a973e393f60</hash>
+            <hash alg="SHA-256">188435794405c7f0573311747c85a96b63c954a5f2111b1df8018979eca0f2f0</hash>
+            <hash alg="SHA-256">1ceebd0ae4f3e9b2b6b553b51971921853ae4eebf3f54086be0565d59291e53d</hash>
+            <hash alg="SHA-256">244e173bb6d8f3b2f0c4d7370a1aa341f35da3e57ffd1798e5b2917b91731fd3</hash>
+            <hash alg="SHA-256">25b28b3d33ec0a78e944aaaed7e5e2a94ac811bcd68b557ca48a0c30f87497d2</hash>
+            <hash alg="SHA-256">25ea41635d22b2eb6326f58e608550e55d01df51b8a580ea7e75396bafbb28e9</hash>
+            <hash alg="SHA-256">29d311e44dd16d2434d5506d57ef4d7036544fc3c25c14b6992ef41f541b10fb</hash>
+            <hash alg="SHA-256">2a1472956c5bcc49fb0252b965239bffe801acc9394f8b7c1014ae9258e4572b</hash>
+            <hash alg="SHA-256">2a7bef6977043673750a88da064fd513f89505111014b4e00fbdd13329cd4e9a</hash>
+            <hash alg="SHA-256">2ac26f50736324beb0282c819668328d53fc38543fa61eeea2c32ea8ea6eab8d</hash>
+            <hash alg="SHA-256">2e72f750048b32d39e87fc85c225c50b2a6715034848dbb196bf3348aa761fa1</hash>
+            <hash alg="SHA-256">31e220a040b89a01505128c2f8a59ee74732f666439a03e65ccbf3824cdddae7</hash>
+            <hash alg="SHA-256">35f53c76a712e323c779ca39b9a81b13f219a8e3bc15f106ed1e1462d56fcfe9</hash>
+            <hash alg="SHA-256">38d4f822ee2f338febcc85aaa2547eb5ba31ba6ff68d10b8ec988929d23bb6b4</hash>
+            <hash alg="SHA-256">38f9bf2ad754b4a45b8210a6c732fe876b8a14e14d5992a8c4b7c1ef78740f53</hash>
+            <hash alg="SHA-256">3a44c8440183b43167fd1a0819e8356692bf5db1ad14ce140dbd40a1485f2dea</hash>
+            <hash alg="SHA-256">3ab96754d23372009638a402a1ed12a27711598dd49d8316a22597141962fe66</hash>
+            <hash alg="SHA-256">3c55d7f2d817183d43220738270efd3ce4e7a7b7cbdaefa6d551ed3d6ed89190</hash>
+            <hash alg="SHA-256">46e1ed994a0920f350a4547a38471217eb86f57377e9314fbaaa329b71b7dfe3</hash>
+            <hash alg="SHA-256">4a5375c5fff13f209527cd886dc75394f040c7d1ecad0a2cb0627f13ebe78a12</hash>
+            <hash alg="SHA-256">4c2d26aa03d877c9730bf005621c92da263523a1e99247590abbbe252ccb7824</hash>
+            <hash alg="SHA-256">4c4e314d36d4f31236a545696a480aa04ea170a0b021e9a59ab1ed94d4c3ef27</hash>
+            <hash alg="SHA-256">4d0c10d803549427f427085ed7aebc39832f6e818a011dcd8785e9c6a1ba9b3e</hash>
+            <hash alg="SHA-256">4dcc5ee1d0275cb78d443fdebd0241e58772a354a6d518b1d7af1580bbd2c4e8</hash>
+            <hash alg="SHA-256">51967a67ea0d7b9b5cd86036878e2d82c0b6183616961c26d825b8c994d4f2c8</hash>
+            <hash alg="SHA-256">530190eb0cd778363bbb7596612ded0bb9fef662daa98e9d92a0419ab27ae914</hash>
+            <hash alg="SHA-256">5379e49d7e80dca9811b36894493d1c1ecb4c57de05c36f5d0dd09982af20211</hash>
+            <hash alg="SHA-256">5493569f861fb7b05af6d048d00d773c6162415ae521b7010197c98810a14cab</hash>
+            <hash alg="SHA-256">5a4c1058cdae6237d97af272b326e5f78ee7ee3bbffa6b24b09db4d828810468</hash>
+            <hash alg="SHA-256">5d75d6d220d55cdced2f32cc22f599475dbe881229aeddba6c79c2e9df35a2b3</hash>
+            <hash alg="SHA-256">5d97e9ae94fb96df1ee3cb09ca376c34e8a122f36927230f4c8a97f469994bff</hash>
+            <hash alg="SHA-256">5feae2f9aa7270e2c071f488fab256d768e88e01b958f123a690f1cc3061a09c</hash>
+            <hash alg="SHA-256">603d5868f7419081d616dab7ac3cfa285296735e7350f7b1e4f548f6f953ee7d</hash>
+            <hash alg="SHA-256">61d42d2b08430854485135504f672c14d4fc644dd243a9c17e7c4e0faf5ed07e</hash>
+            <hash alg="SHA-256">61dbc1e01dc0c5875da2f7ae36d6e918dc1b8d2ce04e871793976594aad8a57a</hash>
+            <hash alg="SHA-256">65cfed9c807c27dee76407e8bb29e6f4e391e436774bcc769a037ff25ad8646e</hash>
+            <hash alg="SHA-256">67a429520e97621a763cf9b3ba27574779c4e96e49a27ff8a1aa99ee70beb28a</hash>
+            <hash alg="SHA-256">6aadae3042f8e6db3376d9e91f194c606c9a45273c170621d46128f35aef7cd0</hash>
+            <hash alg="SHA-256">6ba8858933f0c1a979781272a5f65646fca8c18c93c99c6ddb5513ad96fa54b1</hash>
+            <hash alg="SHA-256">6bc568b05e02cd612be53900c88aaa55012e744930ba2eeb56279db4c6676eb3</hash>
+            <hash alg="SHA-256">729408136ef8d45a28ee9a7411917c9e3459cf266c7e23c2f7d4bb8ef9e0da42</hash>
+            <hash alg="SHA-256">751758d9dd04d548ec679224cc00e3591f5ebf1ff159ed0d4aba6a0746352452</hash>
+            <hash alg="SHA-256">76d59d4d451ba77f08cb4cd9268dec07be5bc65f73666302dbb5061989b17198</hash>
+            <hash alg="SHA-256">79bf58c08f0756adba691d480b5a20e4ad23f33e1ae121584cf3a21717c36dfa</hash>
+            <hash alg="SHA-256">7de12b69d95072394998c622cfd7e8cea8f560db5fca6a62a148f902a1029f8b</hash>
+            <hash alg="SHA-256">7f55cd9cf1564b7b03f238e4c017ca4794c05b01a783e9291065cb2858d86ce4</hash>
+            <hash alg="SHA-256">80e5acb81cb49fd9f2d5c08f8b74ffff14ee73b10ca88297ab4619e946bcb1e1</hash>
+            <hash alg="SHA-256">87a90f5545fd61f6964e65eebde4dc3fa8660bb7d87adb01d4cf17e0a2b484ad</hash>
+            <hash alg="SHA-256">881df98f0a8404d32b6de0fd33e91c1b90ed1516a80d4d6dc69d414b8850474c</hash>
+            <hash alg="SHA-256">8a776a29b77fe0cc28fedfd87277b0d0f7aa930174b7e504d764e0b43a05f381</hash>
+            <hash alg="SHA-256">8c2a61c0e4811012b0ba9f6cdcb4437865df5d29eab5d6018ba13cee1c3064a0</hash>
+            <hash alg="SHA-256">8fa6bd071ec6d90f6e7baa66ae25820d57a8ab1b0a3c6d3edf1834d4b26fafa2</hash>
+            <hash alg="SHA-256">96f2975fb14f39c5fe75203f33dd3010fe37d1c4e33177feef1107b5ced750e3</hash>
+            <hash alg="SHA-256">96fb0899bb2ab353f42e5374c8f0789f54e0a94ef2f02b9ac7149c56622eaf31</hash>
+            <hash alg="SHA-256">97163a1ab265a1073a6372eca9f4eeb9f8c6327457a0b22ddfc4a17dcd613e74</hash>
+            <hash alg="SHA-256">9c95a1a290f9acf7a8f2ebbdd183e99215d491beea52d61aa2a7a7d2c618ddc6</hash>
+            <hash alg="SHA-256">9d94d78418203904730585efa71002286ac4c8ac0689d0eb61e3c465f9e608ff</hash>
+            <hash alg="SHA-256">a6ba2cb7d676e9415b9e9ac7e2aae401dc1b1e666943d1f7bc66223d3d73467b</hash>
+            <hash alg="SHA-256">aa0379c1935c44053c98826bc99ac95f3a5355675a297ac9ce0dfad0ce2d50ca</hash>
+            <hash alg="SHA-256">ac96d67b37f28e4b6ecf507c3405f52a40658c0a806dffde624a8fcb0314d5fd</hash>
+            <hash alg="SHA-256">ade2ccb937060c299ab0dfb2dea3d2ddf7e098ed63ee3d651ebfc2c8d1e8632a</hash>
+            <hash alg="SHA-256">aefbdc934115d2f9278f153952003ac52cd2650e7313750390b334518c589568</hash>
+            <hash alg="SHA-256">b07501b720cf060c5856f7b5626e75b8e353b5f98b9b354a21eb4bfa47e421b1</hash>
+            <hash alg="SHA-256">b5267feb19070bef34b8dea27e2b504ebd9d31748e3ecacb3a4101da6fcb255c</hash>
+            <hash alg="SHA-256">b5f6328e8e2ae8238fc767703ab7b95785521c42bb2b8790984e3477d7fa71ad</hash>
+            <hash alg="SHA-256">b8996ffb60c69f677245f5abdbcc623e9442bcc91ed81b6cd6187129ad1fa3e7</hash>
+            <hash alg="SHA-256">b981a370f8f41c4024c170b42fbe9e691ae2dbc19d1d99151a69e2c84a0d194d</hash>
+            <hash alg="SHA-256">b9d121be0217787a7d59a5c6195b0842d3f701007333426e5154bf72346aa658</hash>
+            <hash alg="SHA-256">bcef4f2d3dc603150421de85c916da19471f24d838c3c62a4f04c1eb511642c1</hash>
+            <hash alg="SHA-256">bed0252c85e21cf73d2d033643c945b460d6a02fc4a7d644e3b2d6f5f2956c64</hash>
+            <hash alg="SHA-256">bfdfbe6a36bc3059fff845d64c42f2644cf875c65f5005db54f90cdfdf1df815</hash>
+            <hash alg="SHA-256">c0095b8aa3e432e32d372e9a7737e65b58d5ed23b9620fea7cb81f17672f1fa1</hash>
+            <hash alg="SHA-256">c1f41d32a2ddc5a94df4b829b395916a4b7f103350fa76ba6de625fcb9e773ac</hash>
+            <hash alg="SHA-256">c45008ca79bad237cbc03c72bc5205e8c6f66403773929b1b50f7d84ef9e4d07</hash>
+            <hash alg="SHA-256">c82bbf7e03748417c3a88c1b0b291288ce3e4887a795a3addaa7a1cfd9e7153e</hash>
+            <hash alg="SHA-256">c918621ee0a3d1fe61c313f2489464f2ae3d13633e60f520a8002a5e910982ee</hash>
+            <hash alg="SHA-256">d204957169f0b3511fb95395a9da7d4490fb361763a9f8b32b345a7fe119cb45</hash>
+            <hash alg="SHA-256">d329896c40d9e1e5c7715c98529e4a188a1f2df51212fd65102b32465612b5dc</hash>
+            <hash alg="SHA-256">d3a61e928feddc458a55110f42f626a2a20bea942ccedb6fb4cee70b4830ed41</hash>
+            <hash alg="SHA-256">d48db29bd47814671afdd76c7652aefacc25cf96aad6daefa82d738ee87461e2</hash>
+            <hash alg="SHA-256">d5593855b5b2b73dd8413c3fdfa5d95b99d657658f947ba2c4318591e745d083</hash>
+            <hash alg="SHA-256">d79c159adea0f1f4617f54aa156568ac69968f9ef4d1e5fefffc0a180830308e</hash>
+            <hash alg="SHA-256">db09b98c7540df69d4b47218da3fbd7cb466db0fb932e971c321f1c76f155266</hash>
+            <hash alg="SHA-256">ddf23960cb42b69bce13045d5bc66f18c7d53774c66c13f24cf1b9c144ba3141</hash>
+            <hash alg="SHA-256">e06cfea0ece444571d24c18ed465bc93afb8c8d8d74422eb7026662f3d3f779b</hash>
+            <hash alg="SHA-256">e7c564c58cf8f248fe859a4f0fe501b050663f3d7fbc342172f259124fb59933</hash>
+            <hash alg="SHA-256">e86593bf8637659e6a6ed58854b6c87ec4e9e45ee8a4adfd936831cef55c2d21</hash>
+            <hash alg="SHA-256">eaffbd8814bb1b5dc3ea156a4c5928081ba50419f9175f4fc95269e040eff8f0</hash>
+            <hash alg="SHA-256">ee353bb51f648924926ed05e0122b6a0b1ae709396a80eb583449d5d477fcdf7</hash>
+            <hash alg="SHA-256">ee6faebb265e28920a6f23a7d4c362414b3f4bb30607141d718b991669e49ddc</hash>
+            <hash alg="SHA-256">efe093acc43e869348f6f2224df7f452eab63a2c60a6c6cd6b50fd35c4e075ba</hash>
+            <hash alg="SHA-256">f03a1b3a4c03e3e0161642ac5367f08479ab29972ea0ffcd4fa18f729cd2be0a</hash>
+            <hash alg="SHA-256">f0d320e70b6b2300ff6029e234e79fe44e9dbbfc7b98597ba28e054bd6606a57</hash>
+            <hash alg="SHA-256">f252dfb4852a527987a9156cbcae3022a30f86c9d26f4f17b8c967d7580d65d2</hash>
+            <hash alg="SHA-256">f5f4424cb87a20b016bfdc157ff48757b89d2cc426256961643d443c6c277007</hash>
+            <hash alg="SHA-256">f8eae66a1304de7368932b42d801c67969fd090ddb1a7a24f27b435ed4bed68f</hash>
+            <hash alg="SHA-256">fdb82eb60d31b0c033a8e8ee9f3fc7dfbaa042211131c29da29aea8531b4f18f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0"/>
+    <dependency ref="attrs==23.1.0"/>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==5.1.1"/>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="isoduration==20.11.0"/>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2"/>
+    <dependency ref="jsonschema==4.20.0"/>
+    <dependency ref="license-expression==30.2.0"/>
+    <dependency ref="lxml==4.9.3"/>
+    <dependency ref="packageurl-python==0.11.2"/>
+    <dependency ref="py-serializable==0.15.0"/>
+    <dependency ref="python-dateutil==2.8.2"/>
+    <dependency ref="referencing==0.31.1"/>
+    <dependency ref="rfc3339-validator==0.1.4"/>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.13.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.5.json.bin b/tests/_data/snapshots/pipenv/with-urls_1.5.json.bin
new file mode 100644
index 00000000..456367ce
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.5.json.bin
@@ -0,0 +1,569 @@
+{
+  "components": [
+    {
+      "bom-ref": "certifi==2023.11.17",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b469f3a900bf28dc19b8cfbf8019bf47f7fdd1a65a1d4ffb98fc14166beb4d1"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e036ab49d5b79556f99cfc2d9320b34cfbe5be05c5871b51de9329f0603b0474"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/certifi@2023.11.17",
+      "type": "library",
+      "version": "2023.11.17"
+    },
+    {
+      "bom-ref": "charset-normalizer==3.3.2",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2127566c664442652f024c837091890cb1942c30937add288223dc895793f898"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/charset-normalizer/"
+        }
+      ],
+      "name": "charset-normalizer",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/charset-normalizer@3.3.2",
+      "type": "library",
+      "version": "3.3.2"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "externalReferences": [
+        {
+          "comment": "from implicit index: pypi",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "pillow",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "pillow",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requests",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375"
+        }
+      ],
+      "name": "requests",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375",
+      "type": "library"
+    },
+    {
+      "bom-ref": "six",
+      "externalReferences": [
+        {
+          "comment": "from git",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
+      "type": "library"
+    },
+    {
+      "bom-ref": "urllib3",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "properties": [
+        {
+          "name": "cdx:pipenv:category",
+          "value": "default"
+        }
+      ],
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "certifi==2023.11.17"
+    },
+    {
+      "ref": "charset-normalizer==3.3.2"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "ref": "pillow"
+    },
+    {
+      "ref": "requests"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "six"
+    },
+    {
+      "ref": "urllib3"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.5.xml.bin b/tests/_data/snapshots/pipenv/with-urls_1.5.xml.bin
new file mode 100644
index 00000000..17f3c9f2
--- /dev/null
+++ b/tests/_data/snapshots/pipenv/with-urls_1.5.xml.bin
@@ -0,0 +1,255 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="certifi==2023.11.17">
+      <name>certifi</name>
+      <version>2023.11.17</version>
+      <purl>pkg:pypi/certifi@2023.11.17</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9b469f3a900bf28dc19b8cfbf8019bf47f7fdd1a65a1d4ffb98fc14166beb4d1</hash>
+            <hash alg="SHA-256">e036ab49d5b79556f99cfc2d9320b34cfbe5be05c5871b51de9329f0603b0474</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="charset-normalizer==3.3.2">
+      <name>charset-normalizer</name>
+      <version>3.3.2</version>
+      <purl>pkg:pypi/charset-normalizer@3.3.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/charset-normalizer/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027</hash>
+            <hash alg="SHA-256">06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087</hash>
+            <hash alg="SHA-256">0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786</hash>
+            <hash alg="SHA-256">0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8</hash>
+            <hash alg="SHA-256">10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09</hash>
+            <hash alg="SHA-256">122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185</hash>
+            <hash alg="SHA-256">1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574</hash>
+            <hash alg="SHA-256">1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e</hash>
+            <hash alg="SHA-256">1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519</hash>
+            <hash alg="SHA-256">2127566c664442652f024c837091890cb1942c30937add288223dc895793f898</hash>
+            <hash alg="SHA-256">22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269</hash>
+            <hash alg="SHA-256">25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3</hash>
+            <hash alg="SHA-256">2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f</hash>
+            <hash alg="SHA-256">3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6</hash>
+            <hash alg="SHA-256">34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8</hash>
+            <hash alg="SHA-256">37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a</hash>
+            <hash alg="SHA-256">3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73</hash>
+            <hash alg="SHA-256">3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc</hash>
+            <hash alg="SHA-256">42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714</hash>
+            <hash alg="SHA-256">45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2</hash>
+            <hash alg="SHA-256">4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc</hash>
+            <hash alg="SHA-256">4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce</hash>
+            <hash alg="SHA-256">4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d</hash>
+            <hash alg="SHA-256">549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e</hash>
+            <hash alg="SHA-256">55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6</hash>
+            <hash alg="SHA-256">572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269</hash>
+            <hash alg="SHA-256">573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96</hash>
+            <hash alg="SHA-256">5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d</hash>
+            <hash alg="SHA-256">6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a</hash>
+            <hash alg="SHA-256">65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4</hash>
+            <hash alg="SHA-256">663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77</hash>
+            <hash alg="SHA-256">6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d</hash>
+            <hash alg="SHA-256">68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0</hash>
+            <hash alg="SHA-256">6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed</hash>
+            <hash alg="SHA-256">6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068</hash>
+            <hash alg="SHA-256">6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac</hash>
+            <hash alg="SHA-256">6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25</hash>
+            <hash alg="SHA-256">753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8</hash>
+            <hash alg="SHA-256">7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab</hash>
+            <hash alg="SHA-256">7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26</hash>
+            <hash alg="SHA-256">7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2</hash>
+            <hash alg="SHA-256">802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db</hash>
+            <hash alg="SHA-256">80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f</hash>
+            <hash alg="SHA-256">8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5</hash>
+            <hash alg="SHA-256">86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99</hash>
+            <hash alg="SHA-256">87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c</hash>
+            <hash alg="SHA-256">8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d</hash>
+            <hash alg="SHA-256">8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811</hash>
+            <hash alg="SHA-256">8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa</hash>
+            <hash alg="SHA-256">8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a</hash>
+            <hash alg="SHA-256">9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03</hash>
+            <hash alg="SHA-256">90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b</hash>
+            <hash alg="SHA-256">923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04</hash>
+            <hash alg="SHA-256">95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c</hash>
+            <hash alg="SHA-256">96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001</hash>
+            <hash alg="SHA-256">9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458</hash>
+            <hash alg="SHA-256">a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389</hash>
+            <hash alg="SHA-256">a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99</hash>
+            <hash alg="SHA-256">a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985</hash>
+            <hash alg="SHA-256">a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537</hash>
+            <hash alg="SHA-256">ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238</hash>
+            <hash alg="SHA-256">aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f</hash>
+            <hash alg="SHA-256">b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d</hash>
+            <hash alg="SHA-256">b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796</hash>
+            <hash alg="SHA-256">b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a</hash>
+            <hash alg="SHA-256">b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143</hash>
+            <hash alg="SHA-256">bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8</hash>
+            <hash alg="SHA-256">beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c</hash>
+            <hash alg="SHA-256">c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5</hash>
+            <hash alg="SHA-256">c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5</hash>
+            <hash alg="SHA-256">c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711</hash>
+            <hash alg="SHA-256">c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4</hash>
+            <hash alg="SHA-256">cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6</hash>
+            <hash alg="SHA-256">d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c</hash>
+            <hash alg="SHA-256">d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7</hash>
+            <hash alg="SHA-256">db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4</hash>
+            <hash alg="SHA-256">ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b</hash>
+            <hash alg="SHA-256">deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae</hash>
+            <hash alg="SHA-256">e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12</hash>
+            <hash alg="SHA-256">e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c</hash>
+            <hash alg="SHA-256">e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae</hash>
+            <hash alg="SHA-256">eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8</hash>
+            <hash alg="SHA-256">eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887</hash>
+            <hash alg="SHA-256">eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b</hash>
+            <hash alg="SHA-256">efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4</hash>
+            <hash alg="SHA-256">f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f</hash>
+            <hash alg="SHA-256">f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5</hash>
+            <hash alg="SHA-256">fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33</hash>
+            <hash alg="SHA-256">fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519</hash>
+            <hash alg="SHA-256">ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>from implicit index: pypi</comment>
+          <hashes>
+            <hash alg="SHA-256">9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca</hash>
+            <hash alg="SHA-256">c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="pillow">
+      <name>pillow</name>
+      <purl>pkg:pypi/pillow?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="requests">
+      <name>requests</name>
+      <purl>pkg:pypi/requests?vcs_url=git%2Bhttps://github.com/requests/requests.git%40a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/requests/requests.git#a25fde6989f8df5c3d823bc9f2e2fc24aa71f375</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six">
+      <name>six</name>
+      <purl>pkg:pypi/six?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from git</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="urllib3">
+      <name>urllib3</name>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>from file</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:pipenv:category">default</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="certifi==2023.11.17"/>
+    <dependency ref="charset-normalizer==3.3.2"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="pillow"/>
+    <dependency ref="requests"/>
+    <dependency ref="root-component"/>
+    <dependency ref="six"/>
+    <dependency ref="urllib3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.5.json.bin
new file mode 100644
index 00000000..a1696501
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.5.json.bin
@@ -0,0 +1,337 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "ddt@1.7.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.7.0",
+      "type": "library",
+      "version": "1.7.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "ddt@1.7.0"
+    },
+    {
+      "dependsOn": [
+        "ddt@1.7.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock11-1.5.xml.bin
new file mode 100644
index 00000000..e17a8606
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock11-1.5.xml.bin
@@ -0,0 +1,249 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ddt@1.7.0">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="ddt@1.7.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="ddt@1.7.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.5.json.bin
new file mode 100644
index 00000000..2888bf97
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.5.json.bin
@@ -0,0 +1,309 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "ddt@1.7.0",
+      "description": "Data-Driven/Decorated Tests",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz"
+        }
+      ],
+      "name": "ddt",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/ddt@1.7.0",
+      "type": "library",
+      "version": "1.7.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "ddt@1.7.0"
+    },
+    {
+      "dependsOn": [
+        "ddt@1.7.0",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps-lock20-1.5.xml.bin
new file mode 100644
index 00000000..55a4759c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/group-deps-lock20-1.5.xml.bin
@@ -0,0 +1,236 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="ddt@1.7.0">
+      <name>ddt</name>
+      <version>1.7.0</version>
+      <description>Data-Driven/Decorated Tests</description>
+      <purl>pkg:pypi/ddt@1.7.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/ddt/#ddt-1.7.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="ddt@1.7.0"/>
+    <dependency ref="group-deps">
+      <dependency ref="ddt@1.7.0"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/local-lock10-1.5.json.bin
new file mode 100644
index 00000000..1aee68d4
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.5.json.bin
@@ -0,0 +1,93 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@23.42",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@23.42"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@23.42"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/local-lock10-1.5.xml.bin
new file mode 100644
index 00000000..8a35f37d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock10-1.5.xml.bin
@@ -0,0 +1,94 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@23.42"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@23.42"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/local-lock11-1.5.json.bin
new file mode 100644
index 00000000..490beef1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.5.json.bin
@@ -0,0 +1,117 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@23.42",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-c@23.42",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@23.42",
+        "package-c@23.42"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@23.42"
+    },
+    {
+      "ref": "package-c@23.42"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/local-lock11-1.5.xml.bin
new file mode 100644
index 00000000..db78b01a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock11-1.5.xml.bin
@@ -0,0 +1,110 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@23.42">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/local-lock20-1.5.json.bin
new file mode 100644
index 00000000..490beef1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.5.json.bin
@@ -0,0 +1,117 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a@23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz"
+        }
+      ],
+      "name": "package-a",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b@23.42",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "from file",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602"
+            }
+          ],
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl"
+        }
+      ],
+      "name": "package-b",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-c@23.42",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "from directory",
+          "type": "distribution",
+          "url": "../../../_helpers/local_pckages/c"
+        }
+      ],
+      "name": "package-c",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "type": "library",
+      "version": "23.42"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "package-a@23.42",
+        "package-b@23.42",
+        "package-c@23.42"
+      ],
+      "ref": "local"
+    },
+    {
+      "ref": "package-a@23.42"
+    },
+    {
+      "ref": "package-b@23.42"
+    },
+    {
+      "ref": "package-c@23.42"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "local",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/local-lock20-1.5.xml.bin
new file mode 100644
index 00000000..db78b01a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/local-lock20-1.5.xml.bin
@@ -0,0 +1,110 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="local">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a@23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/a/dist/package-a-23.42.tar.gz</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">3869fe3f4a6cca5b203b2e2cd8858c834f651e1b0fa76d5c0232e36472199592</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-b@23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/b/dist/package_b-23.42-py3-none-any.whl</url>
+          <comment>from file</comment>
+          <hashes>
+            <hash alg="SHA-256">4aacda53fa274f5ff7eed71a9916904ffb3a11b05dc5ca529d7ddb78ae2dc602</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="package-c@23.42">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>../../../_helpers/local_pckages/c</url>
+          <comment>from directory</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="local">
+      <dependency ref="package-a@23.42"/>
+      <dependency ref="package-b@23.42"/>
+      <dependency ref="package-c@23.42"/>
+    </dependency>
+    <dependency ref="package-a@23.42"/>
+    <dependency ref="package-b@23.42"/>
+    <dependency ref="package-c@23.42"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.json.bin
new file mode 100644
index 00000000..d97e04e6
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.json.bin
@@ -0,0 +1,261 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.xml.bin
new file mode 100644
index 00000000..fe28a996
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.xml.bin
@@ -0,0 +1,200 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.json.bin
new file mode 100644
index 00000000..0f641256
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.json.bin
@@ -0,0 +1,333 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.xml.bin
new file mode 100644
index 00000000..bb1e72f9
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.xml.bin
@@ -0,0 +1,248 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.json.bin
new file mode 100644
index 00000000..fd1632c2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.json.bin
@@ -0,0 +1,309 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "main-and-dev"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "main-and-dev",
+      "description": "main and dev depenndencies",
+      "name": "main-and-dev",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.xml.bin
new file mode 100644
index 00000000..7cf85b1a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.xml.bin
@@ -0,0 +1,236 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="main-and-dev">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>main-and-dev</name>
+      <version>0.1.0</version>
+      <description>main and dev depenndencies</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="main-and-dev">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.5.json.bin
new file mode 100644
index 00000000..fec3326d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.5.json.bin
@@ -0,0 +1,66 @@
+{
+  "dependencies": [
+    {
+      "ref": "no-deps"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com> | My Name",
+      "bom-ref": "no-deps",
+      "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "project metadata: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "package urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "package urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "package urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "project metadata: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "project metadata: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/no-deps-lock20-1.5.xml.bin
new file mode 100644
index 00000000..55a74f6a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-deps-lock20-1.5.xml.bin
@@ -0,0 +1,82 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="no-deps">
+      <author>Your Name &lt;you@example.com&gt; | My Name</author>
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>project metadata: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>package urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package urls: Change log</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>package urls: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>project metadata: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>project metadata: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="no-deps"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.5.json.bin
new file mode 100644
index 00000000..25d06d0b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.5.json.bin
@@ -0,0 +1,75 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock11-1.5.xml.bin
new file mode 100644
index 00000000..b5dd578e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock11-1.5.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.5.json.bin
new file mode 100644
index 00000000..25d06d0b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.5.json.bin
@@ -0,0 +1,75 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev-lock20-1.5.xml.bin
new file mode 100644
index 00000000..b5dd578e
--- /dev/null
+++ b/tests/_data/snapshots/poetry/no-dev-lock20-1.5.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="group-deps">
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.5.json.bin
new file mode 100644
index 00000000..07eda898
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.5.json.bin
@@ -0,0 +1,253 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock11-1.5.xml.bin
new file mode 100644
index 00000000..bb0190a0
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock11-1.5.xml.bin
@@ -0,0 +1,195 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.5.json.bin
new file mode 100644
index 00000000..f7ecb382
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.5.json.bin
@@ -0,0 +1,225 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupB"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "dependsOn": [
+        "isoduration@20.11.0"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups-lock20-1.5.xml.bin
new file mode 100644
index 00000000..9a36e99b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/only-groups-lock20-1.5.xml.bin
@@ -0,0 +1,182 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupB</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="group-deps">
+      <dependency ref="isoduration@20.11.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.5.json.bin
new file mode 100644
index 00000000..20ea9303
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.5.json.bin
@@ -0,0 +1,117 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "ref": "toml@0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock10-1.5.xml.bin
new file mode 100644
index 00000000..71bc1892
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock10-1.5.xml.bin
@@ -0,0 +1,110 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.5.json.bin
new file mode 100644
index 00000000..12a19098
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.5.json.bin
@@ -0,0 +1,1172 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
+      "name": "importlib-metadata",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
+      "name": "jax",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
+      "name": "ml-dtypes",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
+      "name": "opt-einsum",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
+      "name": "scipy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock11-1.5.xml.bin
new file mode 100644
index 00000000..53255d5f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock11-1.5.xml.bin
@@ -0,0 +1,783 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.5.json.bin
new file mode 100644
index 00000000..028a832a
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.5.json.bin
@@ -0,0 +1,1136 @@
+{
+  "components": [
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "importlib-metadata@6.8.0",
+      "description": "Read metadata from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz"
+        }
+      ],
+      "name": "importlib-metadata",
+      "purl": "pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "6.8.0"
+    },
+    {
+      "bom-ref": "jax@0.4.20",
+      "description": "Differentiate, compile, and transform Numpy code.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz"
+        }
+      ],
+      "name": "jax",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html",
+      "type": "library",
+      "version": "0.4.20"
+    },
+    {
+      "bom-ref": "ml-dtypes@0.3.1",
+      "description": "",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz"
+        }
+      ],
+      "name": "ml-dtypes",
+      "purl": "pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.3.1"
+    },
+    {
+      "bom-ref": "numpy@1.26.1",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "purl": "pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "1.26.1"
+    },
+    {
+      "bom-ref": "opt-einsum@3.3.0",
+      "description": "Optimizing numpys einsum function",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz"
+        }
+      ],
+      "name": "opt-einsum",
+      "purl": "pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "3.3.0"
+    },
+    {
+      "bom-ref": "scipy@1.11.3",
+      "description": "Fundamental algorithms for scientific computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz"
+        }
+      ],
+      "name": "scipy",
+      "purl": "pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "1.11.3"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-metadata@6.8.0"
+    },
+    {
+      "dependsOn": [
+        "importlib-metadata@6.8.0",
+        "ml-dtypes@0.3.1",
+        "numpy@1.26.1",
+        "opt-einsum@3.3.0",
+        "scipy@1.11.3"
+      ],
+      "ref": "jax@0.4.20"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "ml-dtypes@0.3.1"
+    },
+    {
+      "ref": "numpy@1.26.1"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "opt-einsum@3.3.0"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "jax@0.4.20",
+        "toml@0.10.2"
+      ],
+      "ref": "private-packges"
+    },
+    {
+      "dependsOn": [
+        "numpy@1.26.1"
+      ],
+      "ref": "scipy@1.11.3"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "private-packges",
+      "description": "packages from aternative package repositories",
+      "name": "private-packges",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges-lock20-1.5.xml.bin
new file mode 100644
index 00000000..6f669d69
--- /dev/null
+++ b/tests/_data/snapshots/poetry/private-packges-lock20-1.5.xml.bin
@@ -0,0 +1,765 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="private-packges">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>private-packges</name>
+      <version>0.1.0</version>
+      <description>packages from aternative package repositories</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-metadata@6.8.0">
+      <name>importlib-metadata</name>
+      <version>6.8.0</version>
+      <description>Read metadata from Python packages</description>
+      <purl>pkg:pypi/importlib-metadata@6.8.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/importlib-metadata/#importlib_metadata-6.8.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jax@0.4.20">
+      <name>jax</name>
+      <version>0.4.20</version>
+      <description>Differentiate, compile, and transform Numpy code.</description>
+      <purl>pkg:pypi/jax@0.4.20?repository_url=https://storage.googleapis.com/jax-releases/jax_releases.html</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d5952197adca548d99310f1c326bf00548f1cc8652b89edb369166482c2aec2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://storage.googleapis.com/jax-releases/jax_releases.html/jax/#jax-0.4.20.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ea96a763a8b1a9374639d1159ab4de163461d01cd022f67c34c09581b71ed2ac</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="ml-dtypes@0.3.1">
+      <name>ml-dtypes</name>
+      <version>0.3.1</version>
+      <description/>
+      <purl>pkg:pypi/ml-dtypes@0.3.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">510d249a91face47211762eb294d6fe64f325356b965fb6388c1bf51bd339267</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f83ff080df8910c0f987f615b03e4f8198638e0c00c6e679ea8892dda909763b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fcae2c69715410d96906e1dfe8f017d9f78a0d10e0df91aae52e91f51fdfe45e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">da274599e4950a9b488d21571061f49a185537cc77f2d3f8121151d58a9e9f16</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5e0b0b6bb07fa5ad11bb61d174667176bee5e05857225067aabfc5adc1b51d23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5727effa7650f7ab10906542d137cfb3244fdc3b2b519beff42f82def8ba59be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">42a8980afd8b7c8e270e8b5c260237286b5b26acd276fcb758d13cd7cb567e99</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb0c404e0dd3e25b56362c1c1e5de0ef717f727dde59fa721af4ce6ab2acca44</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3d8ca0acbd377082792d8b97081ba580abdad67c6afb7f827012c675b052f058</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4828b62fa3bf1ae35faa40f3db9a38ec72fbce02f328a1d14c3a9da4606af364</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1a8dc3bac1da2a17d0e2e4cba36ee89721d0bd33ea4765af2eefb5f41409e0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a777928dcba8865ab4a8157eeb25d23aed7bc82e5fd74e1d5eca821d3f148b39</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-macosx_10_9_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">438437e2e614a3c91d75581653b6c40ec890e8b5994d7190a90c931740151c95</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">70984b473db6489ec1d8c79b082a1322105155193049d08a3b0c515094e9777b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d94b2d1bed77284694f7fd0479640fa7aa5d96433dca3cbcec407a5ef752e77</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">979d7d196d9a17e0135ae22878f74241fbd3522cef58d7b292f1fd5b32282201</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/ml-dtypes/#ml_dtypes-0.3.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">60778f99194b4c4f36ba42da200b35ef851ce4d4af698aaf70f5b91fe70fc611</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="numpy@1.26.1">
+      <name>numpy</name>
+      <version>1.26.1</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.26.1?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">82e871307a6331b5f09efda3c22e03c095d957f04bf6bc1804f30048d0e5e7af</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cdd9ec98f0063d93baeb01aad472a1a0840dee302842a2746a7a8e92968f9575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d78f269e0c4fd365fc2992c00353e4530d274ba68f15e968d8bc3c69ce5f5244</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8ab9163ca8aeb7fd32fe93866490654d2f7dda4e61bc6297bf72ce07fdc02f67</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">78ca54b2f9daffa5f323f34cdf21e1d9779a54073f0018a3094ab907938331a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1cfc92db6af1fd37a7bb58e55c8383b4aa1ba23d012bdbba26b4bcca45ac297</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2984cb6caaf05294b8466966627e80bf6c7afd273279077679cb010acb0e5ab</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd7837b2b734ca72959a1caf3309457a318c934abef7a43a14bb984e574bbb9a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1c59c046c31a43310ad0199d6299e59f57a289e22f0f36951ced1c9eac3665b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d58e8c51a7cf43090d124d5073bc29ab2755822181fcad978b12e144e5e5a4b3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6081aed64714a18c72b168a9276095ef9155dd7888b9e74b5987808f0dd0a974</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">97e5d6a9f0702c2863aaabf19f0d1b6c2628fbe476438ce0b5ce06e83085064c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b9d45d1dbb9de84894cc50efece5b09939752a2d75aab3a8b0cef6f3a35ecd6b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3649d566e2fc067597125428db15d60eb42a4e0897fc48d28cb75dc2e0454e53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1d1bd82d539607951cac963388534da3b7ea0e18b149a53cf883d8f699178c0f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">afd5ced4e5a96dac6725daeb5242a35494243f2239244fad10a90ce58b071d24</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a03fb25610ef560a6201ff06df4f8105292ba56e7cdd196ea350d123fc32e24e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dcfaf015b79d1f9f9c9fd0731a907407dc3e45769262d657d754c3a028586124</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e509cbc488c735b43b5ffea175235cec24bbc57b227ef1acc691725beb230d1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">af22f3d8e228d84d1c0c44c1fbdeb80f97a15a0abe4f080960393a00db733b66</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9f42284ebf91bdf32fafac29d29d4c07e5e9d1af862ea73686581773ef9e73a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bb894accfd16b867d8643fc2ba6c8617c78ba2828051e9a69511644ce86ce83e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e44ccb93f30c75dfc0c3aa3ce38f33486a75ec9abadabd4e59f114994a9c4617</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9696aa2e35cc41e398a6d42d147cf326f8f9d81befcb399bc1ed7ffea339b64e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a5b411040beead47a228bde3b2241100454a6abde9df139ed087bd73fc0a4908</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e11668d6f756ca5ef534b5be8653d16c5352cbb210a5c2a79ff288e937010d5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1d2c6b7dd618c41e202c59c1413ef9b2c8e8a15f5039e344af64195459e3104</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59227c981d43425ca5e5c01094d59eb14e8772ce6975d4b2fc1e106a833d5ae2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">06934e1a22c54636a059215d6da99e23286424f316fddd979f5071093b648668</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">76ff661a867d9272cd2a99eed002470f46dbe0943a5ffd140f49be84f68ffc42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6965888d65d2848e8768824ca8288db0a81263c1efccec881cb35a0d805fcd2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/numpy/#numpy-1.26.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c8c6c72d4a9f831f328efb1312642a1cafafaa88981d9ab76368d50d07d93cbe</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="opt-einsum@3.3.0">
+      <name>opt-einsum</name>
+      <version>3.3.0</version>
+      <description>Optimizing numpys einsum function</description>
+      <purl>pkg:pypi/opt-einsum@3.3.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2455e59e3947d3c275477df7f5205b30635e266fe6dc300e3d9f9646bfcea147</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/opt-einsum/#opt_einsum-3.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">59f6475f77bbc37dcf7cd748519c0ec60722e91e63ca114e68821c0c54a46549</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="scipy@1.11.3">
+      <name>scipy</name>
+      <version>1.11.3</version>
+      <description>Fundamental algorithms for scientific computing in Python</description>
+      <purl>pkg:pypi/scipy@1.11.3?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">370f569c57e1d888304052c18e58f4a927338eafdaef78613c685ca2ea0d1fa0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9885e3e4f13b2bd44aaf2a1a6390a11add9f48d5295f7a592393ceb8991577a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e04aa19acc324a1a076abb4035dabe9b64badb19f76ad9c798bde39d41025cdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3e1a8a4657673bfae1e05e1e1d6e94b0cabe5ed0c7c144c8aa7b7dbb774ce5c1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7abda0e62ef00cde826d441485e2e32fe737bdddee3324e35c0e01dee65e2a88</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">033c3fd95d55012dd1148b201b72ae854d5086d25e7c316ec9850de4fe776929</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">925c6f09d0053b1c0f90b2d92d03b261e889b20d1c9b08a3a51f61afc5f58165</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5664e364f90be8219283eeb844323ff8cd79d7acbd64e15eb9c46b9bc7f6a42a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">00f325434b6424952fbb636506f0567898dca7b0f7654d48f1c382ea338ce9a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f290cf561a4b4edfe8d1001ee4be6da60c1c4ea712985b58bf6bc62badee221</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91770cb3b1e81ae19463b3c235bf1e0e330767dca9eb4cd73ba3ded6c4151e4d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e1f97cd89c0fe1a0685f8f89d85fa305deb3067d0668151571ba50913e445820</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dfcc1552add7cb7c13fb70efcb2389d0624d571aaf2c80b04117e2755a0c5d15</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0d3a136ae1ff0883fffbb1b05b0b2fea251cb1046a5077d0b435a1839b3e52b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bae66a2d7d5768eaa33008fa5a974389f167183c87bf39160d3fefe6664f8ddc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d2f6dee6cbb0e263b8142ed587bc93e3ed5e777f1f75448d24fb923d9fd4dce6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">74e89dc5e00201e71dd94f5f382ab1c6a9f3ff806c7d24e4e90928bb1aafb280</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90271dbde4be191522b3903fc97334e3956d7cfb9cce3f0718d0ab4fd7d8bfd6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_10_9_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a63d1ec9cadecce838467ce0631c17c15c7197ae61e49429434ba01d618caa83</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-macosx_12_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5305792c7110e32ff155aed0df46aa60a60fc6e52cd4ee02cdeb67eaccd5356e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9ea7f579182d83d00fed0e5c11a4aa5ffe01460444219dedc448a36adf0c3917</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c77da50c9a91e23beb63c2a711ef9e9ca9a2060442757dffee34ea41847d8156</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15f237e890c24aef6891c7d008f9ff7e758c6ef39a2b5df264650eb7900403c0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b4bb134c7aa457e26cc6ea482b016fef45db71417d55cc6d8f43d799cdf9ef2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/scipy/#scipy-1.11.3.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bba4d955f54edd61899776bad459bf7326e14b9fa1c552181f0479cc60a568cd</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2?repository_url=http://pysrc2.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc2.acme.org:8080/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0?repository_url=http://pysrc1.acme.org:8080/simple</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>http://pysrc1.acme.org:8080/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="importlib-metadata@6.8.0">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="jax@0.4.20">
+      <dependency ref="importlib-metadata@6.8.0"/>
+      <dependency ref="ml-dtypes@0.3.1"/>
+      <dependency ref="numpy@1.26.1"/>
+      <dependency ref="opt-einsum@3.3.0"/>
+      <dependency ref="scipy@1.11.3"/>
+    </dependency>
+    <dependency ref="ml-dtypes@0.3.1">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="numpy@1.26.1"/>
+    <dependency ref="opt-einsum@3.3.0">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="private-packges">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="jax@0.4.20"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="scipy@1.11.3">
+      <dependency ref="numpy@1.26.1"/>
+    </dependency>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.json.bin
new file mode 100644
index 00000000..b225e59f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.json.bin
@@ -0,0 +1,75 @@
+{
+  "components": [
+    {
+      "bom-ref": "pyhumps@3.7.1",
+      "description": "\ud83d\udc2b  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz"
+        }
+      ],
+      "name": "pyhumps",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/pyhumps@3.7.1",
+      "type": "library",
+      "version": "3.7.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pyhumps@3.7.1"
+    },
+    {
+      "dependsOn": [
+        "pyhumps@3.7.1"
+      ],
+      "ref": "regression-issue611"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "regression-issue611",
+      "description": "regression for issue #611",
+      "name": "regression-issue611",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.xml.bin
new file mode 100644
index 00000000..77b3b946
--- /dev/null
+++ b/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.xml.bin
@@ -0,0 +1,83 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="regression-issue611">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>regression-issue611</name>
+      <version>0.1.0</version>
+      <description>regression for issue #611</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="pyhumps@3.7.1">
+      <name>pyhumps</name>
+      <version>3.7.1</version>
+      <description>🐫  Convert strings (and dictionary keys) between snake case, camel case and pascal case in Python. Inspired by Humps for Node</description>
+      <purl>pkg:pypi/pyhumps@3.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c6f2d833f2c7afae039d71b7dc0aba5412ae5b8c8c33d4a208c1d412de17229e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pyhumps/#pyhumps-3.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5616f0afdbc73ef479fa9999f4abdcb336a0232707ff1a0b86e29fc9339e18da</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="pyhumps@3.7.1"/>
+    <dependency ref="regression-issue611">
+      <dependency ref="pyhumps@3.7.1"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.5.json.bin
new file mode 100644
index 00000000..7cd27829
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.5.json.bin
@@ -0,0 +1,186 @@
+{
+  "components": [
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "license-expression@30.1.1",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock10-1.5.xml.bin
new file mode 100644
index 00000000..33f4b7fc
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock10-1.5.xml.bin
@@ -0,0 +1,148 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.5.json.bin
new file mode 100644
index 00000000..09f7d397
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.5.json.bin
@@ -0,0 +1,2133 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
+      "name": "attrs",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "name": "boolean.py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "name": "defusedxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
+      "name": "fqdn",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
+      "name": "idna",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
+      "name": "importlib-resources",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
+      "name": "jsonpointer",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "name": "license-expression",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "name": "lxml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "name": "packageurl-python",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
+      "name": "pkgutil-resolve-name",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "name": "py-serializable",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
+      "name": "referencing",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
+      "name": "rfc3987",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
+      "name": "rpds-py",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "name": "sortedcontainers",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
+      "name": "uri-template",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
+      "name": "webcolors",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean.py@4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "dependsOn": [
+        "boolean.py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock11-1.5.xml.bin
new file mode 100644
index 00000000..625389e2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock11-1.5.xml.bin
@@ -0,0 +1,1397 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="boolean.py@4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">format</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean.py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean.py@4.0"/>
+    </dependency>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.5.json.bin
new file mode 100644
index 00000000..925a1403
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.5.json.bin
@@ -0,0 +1,3179 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs@23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz"
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean-py@4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz"
+        }
+      ],
+      "name": "boolean-py",
+      "purl": "pkg:pypi/boolean-py@4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib@5.1.1",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "5.1.1"
+    },
+    {
+      "bom-ref": "defusedxml@0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz"
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn@1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz"
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna@3.4",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/#idna-3.4.tar.gz"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.4"
+    },
+    {
+      "bom-ref": "importlib-resources@6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer@2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz"
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema@4.19.2",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz"
+        }
+      ],
+      "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "format"
+        }
+      ],
+      "purl": "pkg:pypi/jsonschema@4.19.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.19.2"
+    },
+    {
+      "bom-ref": "jsonschema-specifications@2023.7.1",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz"
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.7.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "2023.7.1"
+    },
+    {
+      "bom-ref": "license-expression@30.1.1",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl"
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.1.1",
+      "scope": "optional",
+      "type": "library",
+      "version": "30.1.1"
+    },
+    {
+      "bom-ref": "lxml@4.9.3",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz"
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.3",
+      "scope": "optional",
+      "type": "library",
+      "version": "4.9.3"
+    },
+    {
+      "bom-ref": "packageurl-python@0.11.2",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.11.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.11.2"
+    },
+    {
+      "bom-ref": "pkgutil-resolve-name@1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz"
+        }
+      ],
+      "name": "pkgutil-resolve-name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable@0.15.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl"
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.15.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.15.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing@0.30.2",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz"
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.30.2",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.30.2"
+    },
+    {
+      "bom-ref": "rfc3339-validator@0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz"
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987@1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz"
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py@0.12.0",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz"
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.12.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "0.12.0"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers@2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz"
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "scope": "optional",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template@1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl"
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors@1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz"
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "scope": "optional",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp@3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz"
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "scope": "optional",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "attrs@23.1.0"
+    },
+    {
+      "ref": "boolean-py@4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema@4.19.2",
+        "license-expression@30.1.1",
+        "lxml@4.9.3",
+        "packageurl-python@0.11.2",
+        "py-serializable@0.15.0",
+        "sortedcontainers@2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib@5.1.1"
+    },
+    {
+      "ref": "defusedxml@0.7.1"
+    },
+    {
+      "ref": "fqdn@1.5.1"
+    },
+    {
+      "ref": "idna@3.4"
+    },
+    {
+      "dependsOn": [
+        "zipp@3.17.0"
+      ],
+      "ref": "importlib-resources@6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "ref": "jsonpointer@2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources@6.1.1",
+        "referencing@0.30.2"
+      ],
+      "ref": "jsonschema-specifications@2023.7.1"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "fqdn@1.5.1",
+        "idna@3.4",
+        "importlib-resources@6.1.1",
+        "isoduration@20.11.0",
+        "jsonpointer@2.4",
+        "jsonschema-specifications@2023.7.1",
+        "pkgutil-resolve-name@1.3.10",
+        "referencing@0.30.2",
+        "rfc3339-validator@0.1.4",
+        "rfc3987@1.3.8",
+        "rpds-py@0.12.0",
+        "uri-template@1.3.0",
+        "webcolors@1.13"
+      ],
+      "ref": "jsonschema@4.19.2"
+    },
+    {
+      "dependsOn": [
+        "boolean-py@4.0"
+      ],
+      "ref": "license-expression@30.1.1"
+    },
+    {
+      "ref": "lxml@4.9.3"
+    },
+    {
+      "ref": "packageurl-python@0.11.2"
+    },
+    {
+      "ref": "pkgutil-resolve-name@1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml@0.7.1"
+      ],
+      "ref": "py-serializable@0.15.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs@23.1.0",
+        "rpds-py@0.12.0"
+      ],
+      "ref": "referencing@0.30.2"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "rfc3339-validator@0.1.4"
+    },
+    {
+      "ref": "rfc3987@1.3.8"
+    },
+    {
+      "ref": "rpds-py@0.12.0"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "sortedcontainers@2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    },
+    {
+      "ref": "uri-template@1.3.0"
+    },
+    {
+      "ref": "webcolors@1.13"
+    },
+    {
+      "dependsOn": [
+        "cyclonedx-python-lib@5.1.1"
+      ],
+      "ref": "with-extras"
+    },
+    {
+      "ref": "zipp@3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "my-extra"
+        }
+      ],
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras-lock20-1.5.xml.bin
new file mode 100644
index 00000000..72ac9bf1
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-extras-lock20-1.5.xml.bin
@@ -0,0 +1,2092 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+      <properties>
+        <property name="cdx:python:package:extra">my-extra</property>
+      </properties>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs@23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/attrs/#attrs-23.1.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean-py@4.0">
+      <name>boolean-py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/boolean-py@4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2876f2051d7d6394a531d82dc6eb407faa0b01a0a0b3083817ccd7323b8d96bd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/boolean-py/#boolean.py-4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">17b9a181630e43dde1851d42bef546d616d5d9b4480357514597e78b203d06e4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib@5.1.1">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>Python library for CycloneDX</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2989db0cd8bb4c0c442423d71ed7a84ae059e16a2d0f932cc4bf92da7385cdb3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/#cyclonedx_python_lib-5.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">215a636a4e77385d2cf4c6c9801c9bad4791849634f2c6daa45ab2c6cb0a85f6</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="defusedxml@0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/defusedxml/#defusedxml-0.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn@1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3a179af3761e4df6eb2e026ff9e1a3033d3587bf980a0b1b2e1e5d08d7358014</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/fqdn/#fqdn-1.5.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">105ed3677e767fb5ca086a0c1f4bb66ebc3c100be518f0e0d755d9eae164d89f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna@3.4">
+      <name>idna</name>
+      <version>3.4</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/idna@3.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/#idna-3.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources@6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/importlib-resources/#importlib_resources-6.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer@2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">15d51bba20eea3165644553647711d150376234112651b4f1811022aecad7d7a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonpointer/#jsonpointer-2.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">585cee82b70211fa9e6043b7bb89db6e1aa49524340dde8ad6b63206ea689d88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema@4.19.2">
+      <name>jsonschema</name>
+      <version>4.19.2</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema@4.19.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">eee9e502c788e89cb166d4d37f43084e3b64ab405c795c03d343a4dbc2c810fc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema/#jsonschema-4.19.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c9ff4d7447eed9592c23a12ccee508baf0dd0d59650615e847feb6cdca74f392</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">format</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
+      <name>jsonschema-specifications</name>
+      <version>2023.7.1</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/jsonschema-specifications@2023.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/jsonschema-specifications/#jsonschema_specifications-2023.7.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c91a50404e88a1f6ba40636778e2ee08f6e24c5613fe4c53ac24578a5a7f72bb</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression@30.1.1">
+      <name>license-expression</name>
+      <version>30.1.1</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/license-expression@30.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license-expression-30.1.1.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">42375df653ad85e6f5b4b0385138b2dbea1f5d66360783d8625c3e4f97f11f0c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/license-expression/#license_expression-30.1.1-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8d7e5e2de0d04fc104a4f952c440e8f08a5ba63480a0dad015b294770b7e58ec</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml@4.9.3">
+      <name>lxml</name>
+      <version>4.9.3</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/lxml@4.9.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b0a545b46b526d418eb91754565ba5b63b1c0b12f9bd2f808c852d9b4b2f9b5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">075b731ddd9e7f68ad24c635374211376aa05a281673ede86cbe1d1b3455279d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e224d5755dba2f4a9498e150c43792392ac9b5380aa1b845f98a1618c94eeef</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2c74524e179f2ad6d2a4f7caf70e2d96639c0954c943ad601a9e146c76408ed7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1026bc732b6a7f96369f7bfe1a4f2290fb34dce00d8644bc3036fb351a4ca1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c0781a98ff5e6586926293e59480b64ddd46282953203c76ae15dbbbf302e8bb</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp27-cp27mu-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cef2502e7e8a96fe5ad686d60b49e1ab03e438bd9123987994528febd569868e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b86164d2cff4d3aaa1f04a14685cbc072efd0b4f99ca5708b2ad1b9b5988a991</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">42871176e7896d5d45138f6d28751053c711ed4d48d8e30b498da155af39aebd</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ae8b9c6deb1e634ba4f1930eb67ef6e6bf6a44b6eb5ad605642b2d6d5ed9ce3c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">411007c0d88188d9f621b11d252cce90c4a2d1a49db6c068e3c16422f306eab8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd47b4a0d41d2afa3e58e5bf1f62069255aa2fd6ff5ee41604418ca925911d76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e2cb47860da1f7e9a5256254b74ae331687b9672dfa780eed355c4c9c3dbd23</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1247694b26342a7bf47c02e513d32225ededd18045264d40758abeb3c838a51f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cdb650fc86227eba20de1a29d4b2c1bfe139dc75a0669270033cb2ea3d391b85</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp310-cp310-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">97047f0d25cd4bcae81f9ec9dc290ca3e15927c192df17331b53bebe0e3ff96d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f447ea5429b54f9582d4b955f5f1985f278ce5cf169f72eea8afd9502973dd5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">57d6ba0ca2b0c462f339640d22882acc711de224d769edf29962b09f77129cbf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9767e79108424fb6c3edf8f81e6730666a50feb01a328f4a016464a5893f835a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">71c52db65e4b56b8ddc5bb89fb2e66c558ed9d1a74a45ceb7dcb20c191c3df2f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d73d8ecf8ecf10a3bd007f2192725a34bd62898e8da27eb9d32a58084f93962b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0a3d3487f07c1d7f150894c238299934a2a074ef590b583103a45002035be120</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9e28c51fa0ce5674be9f560c6761c1b441631901993f76700b1b30ca6c8378d6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0bfd0767c5c1de2551a120673b72e5d4b628737cb05414f03c3277bf9bed3305</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp311-cp311-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">25f32acefac14ef7bd53e4218fe93b804ef6f6b92ffdb4322bb6d49d94cad2bc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-macosx_11_0_universal2.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d3ff32724f98fbbbfa9f49d82852b159e9784d6094983d9a8b7f2ddaebb063d4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">48d6ed886b343d11493129e019da91d4039826794a3e3027321c56d9e71505be</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9a92d3faef50658dd2c5470af249985782bf754c4e18e15afb67d3ab06233f13</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b4e4bc18382088514ebde9328da057775055940a1f2e18f6ad2d78aa0f3ec5b9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fc9b106a1bf918db68619fdcd6d5ad4f972fdd19c01d19bdb6bf63f3589a9ec5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp312-cp312-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d37017287a7adb6ab77e1c5bee9bcf9660f90ff445042b790402a654d2ad81d8</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">56dc1f1ebccc656d1b3ed288f11e27172a01503fc016bcabdcbc0978b19352b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">578695735c5a3f51569810dfebd05dd6f888147a34f0f98d4bb27e92b76e05c2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">704f61ba8c1283c71b16135caf697557f5ecf3e74d9e453233e4771d68a1f42d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp35-cp35m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c41bfca0bd3532d53d16fd34d20806d5c2b1ace22a2f2e4c0008570bf2c58833</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">64f479d719dc9f4c813ad9bb6b28f8390360660b73b2e4beb4cb0ae7104f1c12</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dd708cf4ee4408cf46a48b108fb9427bfa00b9b85812a9262b5c668af2533ea5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5c31c7462abdf8f2ac0577d9f05279727e698f97ecbb02f17939ea99ae8daa98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e3cd95e10c2610c360154afdc2f1480aea394f4a4f1ea0a5eacce49640c9b190</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4930be26af26ac545c3dffb662521d4e6268352866956672231887d18f0eaab2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4aec80cde9197340bc353d2768e2a75f5f60bacda2bab72ab1dc499589b3878c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">14e019fd83b831b2e61baed40cab76222139926b1fb5ed0e79225bc0cae14584</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0c0850c8b02c298d3c7006b23e98249515ac57430e16a166873fc47a5d549287</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">aca086dc5f9ef98c512bac8efea4483eb84abbf926eaeedf7b91479feb092458</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">50baa9c1c47efcaef189f31e3d00d697c6d4afda5c3cde0302d063492ff9b477</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp36-cp36m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bef4e656f7d98aaa3486d2627e7d2df1157d7e88e7efd43a65aa5dd4714916cf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">46f409a2d60f634fe550f7133ed30ad5321ae2e6630f13657fb9479506b00601</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4c28a9144688aef80d6ea666c809b4b0e50010a2aca784c97f5e6bf143d9f129</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">141f1d1a9b663c679dc524af3ea1773e618907e96075262726c7612c02b149a4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">53ace1c1fd5a74ef662f844a0413446c0629d151055340e9893da958a374f70d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">17a753023436a18e27dd7769e798ce302963c236bc4114ceee5b25c18c52c693</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7d298a1bd60c067ea75d9f684f5f3992c9d6766fadbc0bcedd39750bf344c2f4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">081d32421db5df44c41b7f08a334a090a545c54ba977e47fd7cc2deece78809a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">23eed6d7b1a3336ad92d8e39d4bfe09073c31bfe502f20ca5116b2a334f8ec02</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1509dd12b773c02acd154582088820893109f6ca27ef7291b003d0e81666109f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp37-cp37m-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">120fa9349a24c7043854c53cae8cec227e1f79195a7493e09e0c12e29f918e52</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d2d1edbca80b510443f51afd8496be95529db04a509bc8faee49c7b0fb6d2cc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8d7e43bd40f65f7d97ad8ef5c9b1778943d02f04febef12def25f7583d19baac</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">71d66ee82e7417828af6ecd7db817913cb0cf9d4e61aa0ac1fde0583d84358db</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6fc3c450eaa0b56f815c7b62f2b7fba7266c4779adcf1cece9e6deb1de7305ce</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">65299ea57d82fb91c7f019300d24050c4ddeb7c5a190e076b5f48a2b43d19c42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">eadfbbbfb41b44034a4c757fd5d70baccd43296fb894dba0295606a7cf3124aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3e9bdd30efde2b9ccfa9cb5768ba04fe71b018a25ea093379c857c9dad262c40</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fcdd00edfd0a3001e0181eab3e63bd5c74ad3e67152c84f93f13769a40e073a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">57aba1bbdf450b726d58b2aea5fe47c7875f5afb2c4a23784ed78f19a0462574</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp38-cp38-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">92af161ecbdb2883c4593d5ed4815ea71b31fafd7fd05789b23100d081ecac96</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9bb6ad405121241e99a86efff22d3ef469024ce22875a7ae045896ad23ba2340</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8ed74706b26ad100433da4b9d807eae371efaa266ffc3e9191ea436087a9d6a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fbf521479bcac1e25a663df882c46a641a9bff6b56dc8b0fafaebd2f66fb231b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">303bf1edce6ced16bf67a18a1cf8339d0db79577eec5d9a6d4a80f0fb10aa2da</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5515edd2a6d1a5a70bfcdee23b42ec33425e405c5b351478ab7dc9347228f96e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">690dafd0b187ed38583a648076865d8c229661ed20e48f2335d68e2cf7dc829d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b6420a005548ad52154c8ceab4a1290ff78d757f9e5cbc68f8c77089acd3c432</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bb3bb49c7a6ad9d981d734ef7c7193bc349ac338776a0360cc671eaee89bcf69</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-musllinux_1_1_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d27be7405547d1f958b60837dc4c1007da90b8b23f54ba1f8b728c78fdb19d50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8df133a2ea5e74eef5e8fc6f19b9e085f758768a16e9877a60aec455ed2609b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-cp39-cp39-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4dd9a263e845a72eacb60d12401e37c616438ea2e5442885f65082c276dfb2b2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6689a3d7fd13dc687e9102a27e98ef33730ac4fe37795d5036d18b4d527abd35</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f6bdac493b949141b733c5345b6ba8f87a226029cbabc7e9e121a413e49441e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05186a0f1346ae12553d66df1cfce6f251589fea3ad3da4f3ef4e34b2d58c6a3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c2006f5c8d28dee289f7020f721354362fa304acbaaf9745751ac4006650254b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5c245b783db29c4e4fbbbfc9c5a78be496c9fea25517f90606aa1f6b2b3d5f7b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4fb960a632a49f2f089d522f70496640fdf1218f1243889da3822e0a9f5f3ba7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">50670615eaf97227d5dc60de2dc99fb134a7130d310d783314e7724bf163f75d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9719fe17307a9e814580af1f5c6e05ca593b12fb7e44fe62450a5384dbf61b4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp38-pypy38_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3331bece23c9ee066e0fb3f96c61322b9e0f54d775fccefff4c38ca488de283a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-macosx_11_0_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ed667f49b11360951e201453fc3967344d0d0263aa415e1619e85ae7fd17b4e0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_24_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8b77946fd508cbf0fccd8e400a7f71d4ac0e1595812e66025bac475a8e811694</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e4da8ca0c0c0aea88fd46be8e44bd49716772358d648cce45fe387f7b92374a7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fe4bda6bd4340caa6e5cf95e73f8fea5c4bfc55763dd42f1b50a94c1b4a2fbd4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3-pp39-pypy39_pp73-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f3df3db1d336b9356dd3112eae5f5c2b8b377f3bc826848567f10bfddfee77e9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/lxml/#lxml-4.9.3.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">48628bd53a426c9eb9bc066a923acaa0878d1e86129fd5359aee99285f4eed9c</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python@0.11.2">
+      <name>packageurl-python</name>
+      <version>0.11.2</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/packageurl-python@0.11.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl-python-0.11.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">01fbf74a41ef85cf413f1ede529a1411f658bda66ed22d45d27280ad9ceba471</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/#packageurl_python-0.11.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">799acfe8d9e6e3534bbc19660be97d5b66754bc033e62c39f1e2f16323fcfa84</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil-resolve-name@1.3.10">
+      <name>pkgutil-resolve-name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ca27cc078d25c5ad71a9de0a7a330146c4e014c2462d9af19c6b828280649c5e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/pkgutil-resolve-name/#pkgutil_resolve_name-1.3.10.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">357d6c9e6a755653cfd78893817c0853af365dd51ec97f3d358a819373bbd174</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable@0.15.0">
+      <name>py-serializable</name>
+      <version>0.15.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/py-serializable@0.15.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py-serializable-0.15.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8fc41457d8ee5f5c5a12f41fd87bf1a4f2ecf9da39fee92059b728e78f320771</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/py-serializable/#py_serializable-0.15.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d3f1201b33420c481aa83f7860c7bf2c2f036ba3ea82b6e15a96696457c36cd2</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing@0.30.2">
+      <name>referencing</name>
+      <version>0.30.2</version>
+      <description>JSON Referencing + Python</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/referencing@0.30.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/referencing/#referencing-0.30.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">794ad8003c65938edcdbc027f1933215e0d0ccc0291e3ce20a4d87432b59efc0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator@0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">24f6ec1eda14ef823da9e36ec7113124b39c04d50a4d3d3a3c2859577e7791fa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3339-validator/#rfc3339_validator-0.1.4.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">138a2abdf93304ad60530167e51d2dfb9549521a836871b88d7f4695d0022f6b</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987@1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">10702b1e51e5658843460b189b185c0366d2cf4cff716f13111b0ea9fd2dce53</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rfc3987/#rfc3987-1.3.8.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d3c4d257a560d544e9826b38bc81db676890c79ab9d7ac92b39c7a253d5ca733</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py@0.12.0">
+      <name>rpds-py</name>
+      <version>0.12.0</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/rpds-py@0.12.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c694bee70ece3b232df4678448fdda245fd3b1bb4ba481fb6cd20e13bb784c46</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">30e5ce9f501fb1f970e4a59098028cf20676dee64fc496d55c33e04bbbee097d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d72a4315514e5a0b9837a086cb433b004eea630afb0cc129de76d77654a9606f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">eebaf8c76c39604d52852366249ab807fe6f7a3ffb0dd5484b9944917244cdbe</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a239303acb0315091d54c7ff36712dba24554993b9a93941cf301391d8a997ee</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ced40cdbb6dd47a032725a038896cceae9ce267d340f59508b23537f05455431</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3c8c0226c71bd0ce9892eaf6afa77ae8f43a3d9313124a03df0b389c01f832de</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b8e11715178f3608874508f08e990d3771e0b8c66c73eb4e183038d600a9b274</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5210a0018c7e09c75fa788648617ebba861ae242944111d3079034e14498223f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">171d9a159f1b2f42a42a64a985e4ba46fc7268c78299272ceba970743a67ee50</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-cp310-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">57ec6baec231bb19bb5fd5fc7bae21231860a1605174b11585660236627e390e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7188ddc1a8887194f984fa4110d5a3d5b9b5cd35f6bafdff1b649049cbc0ce29</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp310-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e04581c6117ad9479b6cfae313e212fe0dfa226ac727755f0d539cd54792963</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0a38612d07a36138507d69646c470aedbfe2b75b43a4643f7bd8e51e52779624</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f12d69d568f5647ec503b64932874dade5a20255736c89936bf690951a5e79f5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f8a1d990dc198a6c68ec3d9a637ba1ce489b38cbfb65440a27901afbc5df575</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8c567c664fc2f44130a20edac73e0a867f8e012bf7370276f15c6adc3586c37c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e9e976e0dbed4f51c56db10831c9623d0fd67aac02853fe5476262e5a22acb7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efddca2d02254a52078c35cadad34762adbae3ff01c6b0c7787b59d038b63e0d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d9e7f29c00577aff6b318681e730a519b235af292732a149337f6aaa4d1c5e31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">389c0e38358fdc4e38e9995e7291269a3aead7acfcf8942010ee7bc5baee091c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">33ab498f9ac30598b6406e2be1b45fd231195b83d948ebd4bd77f337cb6a2bff</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d56b1cd606ba4cedd64bb43479d56580e147c6ef3f5d1c5e64203a1adab784a2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-cp311-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1fa73ed22c40a1bec98d7c93b5659cd35abcfa5a0a95ce876b91adbda170537c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">dbc25baa6abb205766fb8606f8263b02c3503a55957fcb4576a6bb0a59d37d10</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp311-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c6b52b7028b547866c2413f614ee306c2d4eafdd444b1ff656bf3295bf1484aa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9620650c364c01ed5b497dcae7c3d4b948daeae6e1883ae185fef1c927b6b534</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2124f9e645a94ab7c853bc0a3644e0ca8ffbe5bb2d72db49aef8f9ec1c285733</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">281c8b219d4f4b3581b918b816764098d04964915b2f272d1476654143801aa2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">27ccc93c7457ef890b0dd31564d2a05e1aca330623c942b7e818e9e7c2669ee4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d1c562a9bb72244fa767d1c1ab55ca1d92dd5f7c4d77878fee5483a22ffac808</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e57919c32ee295a2fca458bb73e4b20b05c115627f96f95a10f9f5acbd61172d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">fa35ad36440aaf1ac8332b4a4a433d4acd28f1613f0d480995f5cfd3580e90b7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e6aea5c0eb5b0faf52c7b5c4a47c8bb64437173be97227c819ffa31801fa4e34</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81cf9d306c04df1b45971c13167dc3bad625808aa01281d55f3cf852dde0e206</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08e6e7ff286254016b945e1ab632ee843e43d45e40683b66dd12b73791366dd1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-cp312-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4d0a675a7acbbc16179188d8c6d0afb8628604fc1241faf41007255957335a0b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2287c09482949e0ca0c0eb68b2aca6cf57f8af8c6dfd29dcd3bc45f17b57978</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp312-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8015835494b21aa7abd3b43fdea0614ee35ef6b03db7ecba9beb58eadf01c24f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6174d6ad6b58a6bcf67afbbf1723420a53d06c4b89f4c50763d6fa0a6ac9afd2</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a689e1ded7137552bea36305a7a16ad2b40be511740b80748d3140614993db98</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f45321224144c25a62052035ce96cbcf264667bcb0d81823b1bbc22c4addd194</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">aa32205358a76bf578854bf31698a86dc8b2cb591fd1d79a833283f4a403f04b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">91bd2b7cf0f4d252eec8b7046fa6a43cee17e8acdfc00eaa8b3dbf2f9a59d061</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3acadbab8b59f63b87b518e09c4c64b142e7286b9ca7a208107d6f9f4c393c5c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">429349a510da82c85431f0f3e66212d83efe9fd2850f50f339341b6532c62fe4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">05942656cb2cb4989cd50ced52df16be94d344eae5097e8583966a1d27da73a5</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0c5441b7626c29dbd54a3f6f3713ec8e956b009f419ffdaaa3c80eaf98ddb523</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b6b0e17d39d21698185097652c611f9cf30f7c56ccec189789920e3e7f1cee56</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-cp38-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">3b7a64d43e2a1fa2dd46b678e00cabd9a49ebb123b339ce799204c44a593ae1c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e5bbe011a2cea9060fef1bb3d668a2fd8432b8888e6d92e74c9c794d3c101595</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp38-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">bec29b801b4adbf388314c0d050e851d53762ab424af22657021ce4b6eb41543</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1096ca0bf2d3426cbe79d4ccc91dc5aaa73629b08ea2d8467375fad8447ce11a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">48aa98987d54a46e13e6954880056c204700c65616af4395d1f0639eba11764b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7979d90ee2190d000129598c2b0c82f13053dba432b94e45e68253b09bb1f0f6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">88857060b690a57d2ea8569bca58758143c8faa4639fb17d745ce60ff84c867e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4eb74d44776b0fb0782560ea84d986dffec8ddd94947f383eba2284b0f32e35e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f62581d7e884dd01ee1707b7c21148f61f2febb7de092ae2f108743fcbef5985</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f5dcb658d597410bb7c967c1d24eaf9377b0d621358cbe9d2ff804e5dd12e81</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9bf9acce44e967a5103fcd820fc7580c7b0ab8583eec4e2051aec560f7b31a63</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">240687b5be0f91fbde4936a329c9b7589d9259742766f74de575e1b2046575e4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">25740fb56e8bd37692ed380e15ec734be44d7c71974d8993f452b4527814601e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-cp39-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a54917b7e9cd3a67e429a630e237a90b096e0ba18897bfb99ee8bd1068a5fea0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win32.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b92aafcfab3d41580d54aca35a8057341f1cfc7c9af9e8bdfc652f83a20ced31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-cp39-none-win_amd64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cd316dbcc74c76266ba94eb021b0cc090b97cca122f50bd7a845f587ff4bf03f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0853da3d5e9bc6a07b2486054a410b7b03f34046c123c6561b535bb48cc509e1</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">cb41ad20064e18a900dd427d7cf41cfaec83bcd1184001f3d91a1f76b3fcea4e</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b710bf7e7ae61957d5c4026b486be593ed3ec3dca3e5be15e0f6d8cf5d0a4990</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a952ae3eb460c6712388ac2ec706d24b0e651b9396d90c9a9e0a69eb27737fdc</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0bedd91ae1dd142a4dc15970ed2c729ff6c73f33a40fa84ed0cdbf55de87c777</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">761531076df51309075133a6bc1db02d98ec7f66e22b064b1d513bc909f29743</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a2baa6be130e8a00b6cbb9f18a33611ec150b4537f8563bddadb54c1b74b8193</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f05450fa1cd7c525c0b9d1a7916e595d3041ac0afbed2ff6926e5afb6a781b7f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">81c4d1a3a564775c44732b94135d06e33417e829ff25226c164664f4a1046213</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">e888be685fa42d8b8a3d3911d5604d14db87538aa7d0b29b1a7ea80d354c732d</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp310-pypy310_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6f8d7fe73d1816eeb5378409adc658f9525ecbfaf9e1ede1e2d67a338b0c7348</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0831d3ecdea22e4559cc1793f22e77067c9d8c451d55ae6a75bf1d116a8e7f42</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">513ccbf7420c30e283c25c82d5a8f439d625a838d3ba69e79a110c260c46813f</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">301bd744a1adaa2f6a5e06c98f1ac2b6f8dc31a5c23b838f862d65e32fca0d4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f8832a4f83d4782a8f5a7b831c47e8ffe164e43c2c148c8160ed9a6d630bc02a</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4b2416ed743ec5debcf61e1242e012652a4348de14ecc7df3512da072b074440</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">35585a8cb5917161f42c2104567bb83a1d96194095fc54a543113ed5df9fa436</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d389ff1e95b6e46ebedccf7fd1fadd10559add595ac6a7c2ea730268325f832c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">9b007c2444705a2dc4a525964fd4dd28c3320b19b3410da6517cab28716f27d3</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">188912b22b6c8225f4c4ffa020a2baa6ad8fabb3c141a12dbe6edbb34e7f1425</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1b4cf9ab9a0ae0cb122685209806d3f1dcb63b9fccdf1424fb42a129dc8c2faa</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp38-pypy38_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">2d34a5450a402b00d20aeb7632489ffa2556ca7b26f4a63c35f6fccae1977427</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_10_7_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">466030a42724780794dea71eb32db83cc51214d66ab3fb3156edd88b9c8f0d78</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-macosx_11_0_arm64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">68172622a5a57deb079a2c78511c40f91193548e8ab342c31e8cb0764d362459</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">54cdfcda59251b9c2f87a05d038c2ae02121219a04d4a1e6fc345794295bdc07</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6b75b912a0baa033350367a8a07a8b2d44fd5b90c890bfbd063a8a5f945f644b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">47aeceb4363851d17f63069318ba5721ae695d9da55d599b4d6fb31508595278</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0525847f83f506aa1e28eb2057b696fe38217e12931c8b1b02198cfe6975e142</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">efbe0b5e0fd078ed7b005faa0170da4f72666360f66f0bb2d7f73526ecfd99f9</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0fadfdda275c838cba5102c7f90a20f2abd7727bf8f4a2b654a5b617529c5c18</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_aarch64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">56dd500411d03c5e9927a1eb55621e906837a83b02350a9dc401247d0353717c</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_i686.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">6915fc9fa6b3ec3569566832e1bb03bd801c12cea030200e68663b9a87974e76</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0-pp39-pypy39_pp73-musllinux_1_2_x86_64.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">5f1519b080d8ce0a814f17ad9fb49fb3a1d4d7ce5891f5c85fc38631ca3a8dc4</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/rpds-py/#rpds_py-0.12.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">7036316cc26b93e401cedd781a579be606dad174829e6ad9e9c5a0da6e036f80</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers@2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/sortedcontainers/#sortedcontainers-2.4.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template@1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri-template-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e00f8eb65e18c7de20d595a14336e9f337ead580c70934141624b6d1ffdacc7</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/uri-template/#uri_template-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">a44a133ea12d44a0c0f06d7d42a52d71282e77e2f937d8abd5655b8d56fc1363</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors@1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">29bc7e8752c0a1bd4a1f03c14d6e6a72e93d82193738fa860cbff59d0fcc11bf</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/webcolors/#webcolors-1.13.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c225b674c83fa923be93d235330ce0300373d02885cef23238813b0d5668304a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp@3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <scope>optional</scope>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/zipp/#zipp-3.17.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs@23.1.0"/>
+    <dependency ref="boolean-py@4.0"/>
+    <dependency ref="cyclonedx-python-lib@5.1.1">
+      <dependency ref="jsonschema@4.19.2"/>
+      <dependency ref="license-expression@30.1.1"/>
+      <dependency ref="lxml@4.9.3"/>
+      <dependency ref="packageurl-python@0.11.2"/>
+      <dependency ref="py-serializable@0.15.0"/>
+      <dependency ref="sortedcontainers@2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml@0.7.1"/>
+    <dependency ref="fqdn@1.5.1"/>
+    <dependency ref="idna@3.4"/>
+    <dependency ref="importlib-resources@6.1.1">
+      <dependency ref="zipp@3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer@2.4"/>
+    <dependency ref="jsonschema-specifications@2023.7.1">
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="referencing@0.30.2"/>
+    </dependency>
+    <dependency ref="jsonschema@4.19.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="fqdn@1.5.1"/>
+      <dependency ref="idna@3.4"/>
+      <dependency ref="importlib-resources@6.1.1"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="jsonpointer@2.4"/>
+      <dependency ref="jsonschema-specifications@2023.7.1"/>
+      <dependency ref="pkgutil-resolve-name@1.3.10"/>
+      <dependency ref="referencing@0.30.2"/>
+      <dependency ref="rfc3339-validator@0.1.4"/>
+      <dependency ref="rfc3987@1.3.8"/>
+      <dependency ref="rpds-py@0.12.0"/>
+      <dependency ref="uri-template@1.3.0"/>
+      <dependency ref="webcolors@1.13"/>
+    </dependency>
+    <dependency ref="license-expression@30.1.1">
+      <dependency ref="boolean-py@4.0"/>
+    </dependency>
+    <dependency ref="lxml@4.9.3"/>
+    <dependency ref="packageurl-python@0.11.2"/>
+    <dependency ref="pkgutil-resolve-name@1.3.10"/>
+    <dependency ref="py-serializable@0.15.0">
+      <dependency ref="defusedxml@0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="referencing@0.30.2">
+      <dependency ref="attrs@23.1.0"/>
+      <dependency ref="rpds-py@0.12.0"/>
+    </dependency>
+    <dependency ref="rfc3339-validator@0.1.4">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987@1.3.8"/>
+    <dependency ref="rpds-py@0.12.0"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="sortedcontainers@2.4.0"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+    <dependency ref="uri-template@1.3.0"/>
+    <dependency ref="webcolors@1.13"/>
+    <dependency ref="with-extras">
+      <dependency ref="cyclonedx-python-lib@5.1.1"/>
+    </dependency>
+    <dependency ref="zipp@3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.5.json.bin
new file mode 100644
index 00000000..efee818b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.5.json.bin
@@ -0,0 +1,341 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        },
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "dev"
+        }
+      ],
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock11-1.5.xml.bin
new file mode 100644
index 00000000..a00e46b0
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock11-1.5.xml.bin
@@ -0,0 +1,250 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">dev</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.5.json.bin
new file mode 100644
index 00000000..f2006a4d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.5.json.bin
@@ -0,0 +1,309 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow@1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "colorama@0.4.6",
+      "description": "Cross-platform colored terminal text.",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    },
+    {
+      "bom-ref": "isoduration@20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz"
+        }
+      ],
+      "name": "isoduration",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "groupA"
+        }
+      ],
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "python-dateutil@2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl"
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/six/#six-1.16.0.tar.gz"
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "toml@0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/toml/#toml-0.10.2.tar.gz"
+        }
+      ],
+      "name": "toml",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    },
+    {
+      "bom-ref": "types-python-dateutil@2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz"
+        },
+        {
+          "comment": "from legacy-api",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl"
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil@2.8.2",
+        "types-python-dateutil@2.8.19.14"
+      ],
+      "ref": "arrow@1.3.0"
+    },
+    {
+      "ref": "colorama@0.4.6"
+    },
+    {
+      "dependsOn": [
+        "colorama@0.4.6",
+        "isoduration@20.11.0",
+        "toml@0.10.2"
+      ],
+      "ref": "group-deps"
+    },
+    {
+      "dependsOn": [
+        "arrow@1.3.0"
+      ],
+      "ref": "isoduration@20.11.0"
+    },
+    {
+      "dependsOn": [
+        "six@1.16.0"
+      ],
+      "ref": "python-dateutil@2.8.2"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "ref": "toml@0.10.2"
+    },
+    {
+      "ref": "types-python-dateutil@2.8.19.14"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "group-deps",
+      "description": "dependencies organized in groups",
+      "name": "group-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups-lock20-1.5.xml.bin
new file mode 100644
index 00000000..39025b2c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/some-groups-lock20-1.5.xml.bin
@@ -0,0 +1,236 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="group-deps">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>group-deps</name>
+      <version>0.1.0</version>
+      <description>dependencies organized in groups</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow@1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/arrow/#arrow-1.3.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="colorama@0.4.6">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>Cross-platform colored terminal text.</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/#colorama-0.4.6.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="isoduration@20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/isoduration/#isoduration-20.11.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">groupA</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="python-dateutil@2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python-dateutil-2.8.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/python-dateutil/#python_dateutil-2.8.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/six/#six-1.16.0.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="toml@0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2-py2.py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/toml/#toml-0.10.2.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil@2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types-python-dateutil-2.8.19.14.tar.gz</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b</hash>
+          </hashes>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/types-python-dateutil/#types_python_dateutil-2.8.19.14-py3-none-any.whl</url>
+          <comment>from legacy-api</comment>
+          <hashes>
+            <hash alg="SHA-256">f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow@1.3.0">
+      <dependency ref="python-dateutil@2.8.2"/>
+      <dependency ref="types-python-dateutil@2.8.19.14"/>
+    </dependency>
+    <dependency ref="colorama@0.4.6"/>
+    <dependency ref="group-deps">
+      <dependency ref="colorama@0.4.6"/>
+      <dependency ref="isoduration@20.11.0"/>
+      <dependency ref="toml@0.10.2"/>
+    </dependency>
+    <dependency ref="isoduration@20.11.0">
+      <dependency ref="arrow@1.3.0"/>
+    </dependency>
+    <dependency ref="python-dateutil@2.8.2">
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="toml@0.10.2"/>
+    <dependency ref="types-python-dateutil@2.8.19.14"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.5.json.bin
new file mode 100644
index 00000000..707fb92c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.5.json.bin
@@ -0,0 +1,29 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock10-1.5.xml.bin
new file mode 100644
index 00000000..c4f928d2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock10-1.5.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.5.json.bin
new file mode 100644
index 00000000..707fb92c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.5.json.bin
@@ -0,0 +1,29 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock11-1.5.xml.bin
new file mode 100644
index 00000000..c4f928d2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock11-1.5.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.5.json.bin
new file mode 100644
index 00000000..707fb92c
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.5.json.bin
@@ -0,0 +1,29 @@
+{
+  "dependencies": [
+    {
+      "ref": "with-extras"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-extras",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras-lock20-1.5.xml.bin
new file mode 100644
index 00000000..c4f928d2
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-extras-lock20-1.5.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-extras">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-extras</name>
+      <version>0.1.0</version>
+      <description>depenndencies with extras</description>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="with-extras"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.5.json.bin
new file mode 100644
index 00000000..30d2bb7b
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.5.json.bin
@@ -0,0 +1,146 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock10-1.5.xml.bin
new file mode 100644
index 00000000..0258a02f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock10-1.5.xml.bin
@@ -0,0 +1,130 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:source:package:reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:source:package:reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.5.json.bin
new file mode 100644
index 00000000..674c8c1f
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.5.json.bin
@@ -0,0 +1,154 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "10.1.0"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "1.16.0"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock11-1.5.xml.bin
new file mode 100644
index 00000000..eefb84ff
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock11-1.5.xml.bin
@@ -0,0 +1,132 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+        <property name="cdx:poetry:source:package:reference">10.1.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+        <property name="cdx:poetry:source:package:reference">1.16.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.5.json.bin
new file mode 100644
index 00000000..03b723d7
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.5.json.bin
@@ -0,0 +1,166 @@
+{
+  "components": [
+    {
+      "bom-ref": "Pillow@10.1.0",
+      "description": "Python Imaging Library (Fork)",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c"
+        }
+      ],
+      "name": "Pillow",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "da59ad000d1405eaecd557175e29083a87d19f7c"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "10.1.0"
+        }
+      ],
+      "purl": "pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c",
+      "type": "library",
+      "version": "10.1.0"
+    },
+    {
+      "bom-ref": "numpy@1.24.4",
+      "description": "Fundamental package for array computing in Python",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "80f5e3a4e498641401868df4208b74581206afbee7cf7b8329daae82676d9463"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz"
+        }
+      ],
+      "name": "numpy",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/numpy@1.24.4",
+      "type": "library",
+      "version": "1.24.4"
+    },
+    {
+      "bom-ref": "six@1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "from VCS",
+          "type": "vcs",
+          "url": "git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1"
+        }
+      ],
+      "name": "six",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        },
+        {
+          "name": "cdx:poetry:package:source:resolved_reference",
+          "value": "65486e4383f9f411da95937451205d3c7b61b9e1"
+        },
+        {
+          "name": "cdx:poetry:source:package:reference",
+          "value": "1.16.0"
+        }
+      ],
+      "purl": "pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "wxPython@4.2.2a1.dev5618+1f82021f",
+      "description": "Cross platform GUI toolkit for Python, \"Phoenix\" version",
+      "externalReferences": [
+        {
+          "comment": "from url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "6ebb5019c6b999941a6cddd298dff7951d826239d663f6ce698b9547ae72d6b9"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl"
+        }
+      ],
+      "name": "wxPython",
+      "properties": [
+        {
+          "name": "cdx:poetry:group",
+          "value": "main"
+        }
+      ],
+      "purl": "pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl",
+      "type": "library",
+      "version": "4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "Pillow@10.1.0"
+    },
+    {
+      "ref": "numpy@1.24.4"
+    },
+    {
+      "ref": "six@1.16.0"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0",
+        "wxPython@4.2.2a1.dev5618+1f82021f"
+      ],
+      "ref": "with-urls"
+    },
+    {
+      "dependsOn": [
+        "Pillow@10.1.0",
+        "numpy@1.24.4",
+        "six@1.16.0"
+      ],
+      "ref": "wxPython@4.2.2a1.dev5618+1f82021f"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "author": "Your Name <you@example.com>",
+      "bom-ref": "with-urls",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls-lock20-1.5.xml.bin
new file mode 100644
index 00000000..8c7f7b5d
--- /dev/null
+++ b/tests/_data/snapshots/poetry/with-urls-lock20-1.5.xml.bin
@@ -0,0 +1,138 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="with-urls">
+      <author>Your Name &lt;you@example.com&gt;</author>
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="Pillow@10.1.0">
+      <name>Pillow</name>
+      <version>10.1.0</version>
+      <description>Python Imaging Library (Fork)</description>
+      <purl>pkg:pypi/pillow@10.1.0?vcs_url=git%2Bhttps://github.com/python-pillow/Pillow.git%40da59ad000d1405eaecd557175e29083a87d19f7c</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/python-pillow/Pillow.git#da59ad000d1405eaecd557175e29083a87d19f7c</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">da59ad000d1405eaecd557175e29083a87d19f7c</property>
+        <property name="cdx:poetry:source:package:reference">10.1.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="numpy@1.24.4">
+      <name>numpy</name>
+      <version>1.24.4</version>
+      <description>Fundamental package for array computing in Python</description>
+      <purl>pkg:pypi/numpy@1.24.4</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/a4/9b/027bec52c633f6556dba6b722d9a0befb40498b9ceddd29cbe67a45a127c/numpy-1.24.4.tar.gz</url>
+          <comment>from url</comment>
+          <hashes>
+            <hash alg="SHA-256">80f5e3a4e498641401868df4208b74581206afbee7cf7b8329daae82676d9463</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="six@1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0?vcs_url=git%2Bssh://git%40github.com/benjaminp/six.git%4065486e4383f9f411da95937451205d3c7b61b9e1</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+ssh://git@github.com/benjaminp/six.git#65486e4383f9f411da95937451205d3c7b61b9e1</url>
+          <comment>from VCS</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+        <property name="cdx:poetry:package:source:resolved_reference">65486e4383f9f411da95937451205d3c7b61b9e1</property>
+        <property name="cdx:poetry:source:package:reference">1.16.0</property>
+      </properties>
+    </component>
+    <component type="library" bom-ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <name>wxPython</name>
+      <version>4.2.2a1.dev5618+1f82021f</version>
+      <description>Cross platform GUI toolkit for Python, &quot;Phoenix&quot; version</description>
+      <purl>pkg:pypi/wxpython@4.2.2a1.dev5618%2B1f82021f?download_url=https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618%2B1f82021f-cp38-cp38-win32.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://wxpython.org/Phoenix/snapshot-builds/wxPython-4.2.2a1.dev5618+1f82021f-cp38-cp38-win32.whl</url>
+          <comment>from url</comment>
+          <hashes>
+            <hash alg="SHA-256">6ebb5019c6b999941a6cddd298dff7951d826239d663f6ce698b9547ae72d6b9</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:poetry:group">main</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="Pillow@10.1.0"/>
+    <dependency ref="numpy@1.24.4"/>
+    <dependency ref="six@1.16.0"/>
+    <dependency ref="with-urls">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+      <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f"/>
+    </dependency>
+    <dependency ref="wxPython@4.2.2a1.dev5618+1f82021f">
+      <dependency ref="Pillow@10.1.0"/>
+      <dependency ref="numpy@1.24.4"/>
+      <dependency ref="six@1.16.0"/>
+    </dependency>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.5.json-file.bin
new file mode 100644
index 00000000..5953eb83
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.5.json-file.bin
@@ -0,0 +1,81 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/FooProject/"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..6ae1a512
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.5.json-stream.bin
@@ -0,0 +1,66 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/FooProject/"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..82bdbd9d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-file.bin
@@ -0,0 +1,87 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..154250b1
--- /dev/null
+++ b/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-stream.bin
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/local.txt-1.5.json-file.bin
new file mode 100644
index 00000000..a1da370d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.5.json-file.bin
@@ -0,0 +1,138 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
+      "name": "foo",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+            }
+          ],
+          "type": "other",
+          "url": "./myproject/requests"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..b4727344
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.5.json-stream.bin
@@ -0,0 +1,123 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: foo @ file://../foo",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "file://../foo"
+        }
+      ],
+      "name": "foo",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L14",
+      "description": "requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./downloads/numpy-1.9.2-cp34-none-win32.whl"
+        }
+      ],
+      "name": "numpy",
+      "type": "library",
+      "version": "1.9.2"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: ./myproject/chardet",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/chardet"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804"
+            }
+          ],
+          "type": "other",
+          "url": "./myproject/requests"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: -e ./myproject/idna.whl",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./myproject/idna.whl"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L17",
+      "description": "requirements line 17: ./downloads/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "explicit local path",
+          "type": "other",
+          "url": "./downloads/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L14"
+    },
+    {
+      "ref": "requirements-L17"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/local.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..8487093f
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.5.xml-file.bin
@@ -0,0 +1,127 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>foo</name>
+      <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>unknown</name>
+      <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>unknown</name>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
+          <hashes>
+            <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/local.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..b81decfc
--- /dev/null
+++ b/tests/_data/snapshots/requirements/local.txt-1.5.xml-stream.bin
@@ -0,0 +1,118 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>foo</name>
+      <description>requirements line 11: foo @ file://../foo</description>
+      <externalReferences>
+        <reference type="other">
+          <url>file://../foo</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L14">
+      <name>numpy</name>
+      <version>1.9.2</version>
+      <description>requirements line 14: ./downloads/numpy-1.9.2-cp34-none-win32.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.9.2-cp34-none-win32.whl</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>unknown</name>
+      <description>requirements line 2: ./myproject/chardet</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/chardet</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>unknown</name>
+      <description>requirements line 5: ./myproject/requests --hash=sha256:27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/requests</url>
+          <comment>explicit local path</comment>
+          <hashes>
+            <hash alg="SHA-256">27973dd4a904a4f13b263a19c866c13b92a39ed1c964655f025f3f8d3d75b804</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>unknown</name>
+      <description>requirements line 8: -e ./myproject/idna.whl</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./myproject/idna.whl</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L17">
+      <name>unknown</name>
+      <description>requirements line 17: ./downloads/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="other">
+          <url>./downloads/numpy-1.26.1.tar.gz</url>
+          <comment>explicit local path</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L14"/>
+    <dependency ref="requirements-L17"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.5.json-file.bin
new file mode 100644
index 00000000..5953eb83
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.5.json-file.bin
@@ -0,0 +1,81 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/FooProject/"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: colorama==0.4.6",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/colorama/"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama@0.4.6",
+      "type": "library",
+      "version": "0.4.6"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..73ba6b6d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.5.json-stream.bin
@@ -0,0 +1,16 @@
+{
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/nested.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..82bdbd9d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.5.xml-file.bin
@@ -0,0 +1,87 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 7: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>colorama</name>
+      <version>0.4.6</version>
+      <description>requirements line 4: colorama==0.4.6</description>
+      <purl>pkg:pypi/colorama@0.4.6</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/colorama/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/nested.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..5c6fa3bd
--- /dev/null
+++ b/tests/_data/snapshots/requirements/nested.txt-1.5.xml-stream.bin
@@ -0,0 +1,44 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+</bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-file.bin
new file mode 100644
index 00000000..7bbc91fc
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-file.bin
@@ -0,0 +1,63 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypackages.acme.org/simple//my-package/"
+        }
+      ],
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..309d0f87
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-stream.bin
@@ -0,0 +1,48 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: my-package==1.2.3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy1.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist extra-url",
+          "type": "distribution",
+          "url": "https://legacy2.pypackages.acme.org/simple//my-package/"
+        },
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypackages.acme.org/simple//my-package/"
+        }
+      ],
+      "name": "my-package",
+      "purl": "pkg:pypi/my-package@1.2.3",
+      "type": "library",
+      "version": "1.2.3"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..5fb2ea84
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-file.bin
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
+      <version>1.2.3</version>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..d56eef48
--- /dev/null
+++ b/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-stream.bin
@@ -0,0 +1,69 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L7">
+      <name>my-package</name>
+      <version>1.2.3</version>
+      <description>requirements line 7: my-package==1.2.3</description>
+      <purl>pkg:pypi/my-package@1.2.3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://legacy1.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://legacy2.pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist extra-url</comment>
+        </reference>
+        <reference type="distribution">
+          <url>https://pypackages.acme.org/simple//my-package/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.json-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.json-stream.bin
new file mode 100644
index 00000000..c8a937a5
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.json-stream.bin
@@ -0,0 +1,71 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.xml-stream.bin
new file mode 100644
index 00000000..73f295e4
--- /dev/null
+++ b/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.xml-stream.bin
@@ -0,0 +1,84 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-file.bin
new file mode 100644
index 00000000..bb2dd25f
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-file.bin
@@ -0,0 +1,125 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..292292fb
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-stream.bin
@@ -0,0 +1,110 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi==2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet==4.0.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet@4.0.0",
+      "type": "library",
+      "version": "4.0.0"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: idna==2.10",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/idna/"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@2.10",
+      "type": "library",
+      "version": "2.10"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: requests==2.25.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requests/"
+        }
+      ],
+      "name": "requests",
+      "purl": "pkg:pypi/requests@2.25.1",
+      "type": "library",
+      "version": "2.25.1"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: urllib3==1.26.5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L5"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..66eac740
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-file.bin
@@ -0,0 +1,122 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>idna</name>
+      <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
+      <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..cc7d80dd
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-stream.bin
@@ -0,0 +1,113 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 1: certifi==2021.5.30</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <version>4.0.0</version>
+      <description>requirements line 2: chardet==4.0.0</description>
+      <purl>pkg:pypi/chardet@4.0.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>idna</name>
+      <version>2.10</version>
+      <description>requirements line 3: idna==2.10</description>
+      <purl>pkg:pypi/idna@2.10</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/idna/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>requests</name>
+      <version>2.25.1</version>
+      <description>requirements line 4: requests==2.25.1</description>
+      <purl>pkg:pypi/requests@2.25.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requests/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 5: urllib3==1.26.5</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L5"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-file.bin
new file mode 100644
index 00000000..4402bc17
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-file.bin
@@ -0,0 +1,63 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..c8359c9f
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-stream.bin
@@ -0,0 +1,48 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/cyclonedx-python-lib/"
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "properties": [
+        {
+          "name": "cdx:python:package:extra",
+          "value": "json-validation"
+        },
+        {
+          "name": "cdx:python:package:extra",
+          "value": "xml-validation"
+        }
+      ],
+      "purl": "pkg:pypi/cyclonedx-python-lib@5.1.1",
+      "type": "library",
+      "version": "5.1.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..eb258efb
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-file.bin
@@ -0,0 +1,74 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..acde8a62
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-stream.bin
@@ -0,0 +1,65 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L3">
+      <name>cyclonedx-python-lib</name>
+      <version>5.1.1</version>
+      <description>requirements line 3: cyclonedx-python-lib[json-validation,xml-validation] == 5.1.1</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/cyclonedx-python-lib/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+      <properties>
+        <property name="cdx:python:package:extra">json-validation</property>
+        <property name="cdx:python:package:extra">xml-validation</property>
+      </properties>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-file.bin
new file mode 100644
index 00000000..6b8002aa
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-file.bin
@@ -0,0 +1,164 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/FooProject/"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "hashes": [
+            {
+              "alg": "MD5",
+              "content": "9854316552d41419b678d39af443a75f"
+            },
+            {
+              "alg": "SHA-1",
+              "content": "aa1fc7722b9128a3c945048de03f5b4e55157c6a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..8bc5d913
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-stream.bin
@@ -0,0 +1,149 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/FooProject/"
+        }
+      ],
+      "name": "FooProject",
+      "purl": "pkg:pypi/fooproject@1.2",
+      "type": "library",
+      "version": "1.2"
+    },
+    {
+      "bom-ref": "requirements-L4",
+      "description": "requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi@2021.5.30",
+      "type": "library",
+      "version": "2021.5.30"
+    },
+    {
+      "bom-ref": "requirements-L16",
+      "description": "requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "hashes": [
+            {
+              "alg": "MD5",
+              "content": "9854316552d41419b678d39af443a75f"
+            },
+            {
+              "alg": "SHA-1",
+              "content": "aa1fc7722b9128a3c945048de03f5b4e55157c6a"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz"
+        }
+      ],
+      "name": "colorama",
+      "purl": "pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L21",
+      "description": "requirements line 21: something == 1.33.7 --hash=foo:something-invalid",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/something/"
+        }
+      ],
+      "name": "something",
+      "purl": "pkg:pypi/something@1.33.7",
+      "type": "library",
+      "version": "1.33.7"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c"
+            },
+            {
+              "alg": "SHA-256",
+              "content": "a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.5",
+      "type": "library",
+      "version": "1.26.5"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L16"
+    },
+    {
+      "ref": "requirements-L21"
+    },
+    {
+      "ref": "requirements-L4"
+    },
+    {
+      "ref": "requirements-L7"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..519512fc
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-file.bin
@@ -0,0 +1,137 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+            <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L16">
+      <name>colorama</name>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
+          <hashes>
+            <hash alg="MD5">9854316552d41419b678d39af443a75f</hash>
+            <hash alg="SHA-1">aa1fc7722b9128a3c945048de03f5b4e55157c6a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+            <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..891a8045
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-stream.bin
@@ -0,0 +1,128 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>FooProject</name>
+      <version>1.2</version>
+      <description>requirements line 11: FooProject == 1.2   --hash=sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824   --hash=sha256:486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</description>
+      <purl>pkg:pypi/fooproject@1.2</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/FooProject/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824</hash>
+            <hash alg="SHA-256">486ea46224d1bb4fb680f34f7c9ad96a8f24ec88be73ea8e5a6c65260e9cb8a7</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L4">
+      <name>certifi</name>
+      <version>2021.5.30</version>
+      <description>requirements line 4: certifi==2021.5.30 --hash=sha256:2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee --hash=sha256:50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</description>
+      <purl>pkg:pypi/certifi@2021.5.30</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">2bbf76fd432960138b3ef6dda3dde0544f27cbf8546c458e60baf371917ba9ee</hash>
+            <hash alg="SHA-256">50b1e4f8446b06f41be7dd6338db18e0990601dce795c2b1686458aa7e8fa7d8</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L16">
+      <name>colorama</name>
+      <description>requirements line 16: colorama @ https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz     --hash=md5:9854316552d41419b678d39af443a75f     --hash=sha1:aa1fc7722b9128a3c945048de03f5b4e55157c6a</description>
+      <purl>pkg:pypi/colorama?download_url=https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/tartley/colorama/archive/refs/tags/0.4.6.tar.gz</url>
+          <comment>explicit dist url</comment>
+          <hashes>
+            <hash alg="MD5">9854316552d41419b678d39af443a75f</hash>
+            <hash alg="SHA-1">aa1fc7722b9128a3c945048de03f5b4e55157c6a</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L21">
+      <name>something</name>
+      <version>1.33.7</version>
+      <description>requirements line 21: something == 1.33.7 --hash=foo:something-invalid</description>
+      <purl>pkg:pypi/something@1.33.7</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/something/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>urllib3</name>
+      <version>1.26.5</version>
+      <description>requirements line 7: urllib3==1.26.5 --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c  --hash=sha256:a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</description>
+      <purl>pkg:pypi/urllib3@1.26.5</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+          <hashes>
+            <hash alg="SHA-256">753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c</hash>
+            <hash alg="SHA-256">a7acd0977125325f516bda9735fa7142b909a8d01e8b2e4c8108d0984e6e0098</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L16"/>
+    <dependency ref="requirements-L21"/>
+    <dependency ref="requirements-L4"/>
+    <dependency ref="requirements-L7"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-file.bin
new file mode 100644
index 00000000..168903b3
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-file.bin
@@ -0,0 +1,154 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L15"
+    },
+    {
+      "ref": "requirements-L19"
+    },
+    {
+      "ref": "requirements-L23"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L9"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..7cf43bb0
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-stream.bin
@@ -0,0 +1,139 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L11",
+      "description": "requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four"
+        }
+      ],
+      "name": "package-four",
+      "purl": "pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L5",
+      "description": "requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-one@41b95ec#egg=package-one"
+        }
+      ],
+      "name": "package-one",
+      "purl": "pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L9",
+      "description": "requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-three@0.1#egg=package-three"
+        }
+      ],
+      "name": "package-three",
+      "purl": "pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "vcs",
+          "url": "git+https://github.com/path/to/package-two@master#egg=package-two"
+        }
+      ],
+      "name": "package-two",
+      "purl": "pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L19",
+      "description": "requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz"
+        }
+      ],
+      "name": "unknown",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L23",
+      "description": "requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L15",
+      "description": "requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl",
+      "externalReferences": [
+        {
+          "comment": "explicit dist url",
+          "type": "distribution",
+          "url": "http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl"
+        }
+      ],
+      "name": "wxPython-Phoenix",
+      "purl": "pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl",
+      "type": "library",
+      "version": "3.0.3.dev1820+49a8884"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L11"
+    },
+    {
+      "ref": "requirements-L15"
+    },
+    {
+      "ref": "requirements-L19"
+    },
+    {
+      "ref": "requirements-L23"
+    },
+    {
+      "ref": "requirements-L5"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L9"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..c9d945c5
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-file.bin
@@ -0,0 +1,141 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>package-four</name>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>package-one</name>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L9">
+      <name>package-three</name>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>package-two</name>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L19">
+      <name>unknown</name>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L23">
+      <name>urllib3</name>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..8d782f29
--- /dev/null
+++ b/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-stream.bin
@@ -0,0 +1,132 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L11">
+      <name>package-four</name>
+      <description>requirements line 11: git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</description>
+      <purl>pkg:pypi/package-four?vcs_url=git%2Bhttps://github.com/path/to/package-four%40releases/tag/v3.7.1%23egg%3Dpackage-four</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-four@releases/tag/v3.7.1#egg=package-four</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L5">
+      <name>package-one</name>
+      <description>requirements line 5: git+https://github.com/path/to/package-one@41b95ec#egg=package-one</description>
+      <purl>pkg:pypi/package-one?vcs_url=git%2Bhttps://github.com/path/to/package-one%4041b95ec%23egg%3Dpackage-one</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-one@41b95ec#egg=package-one</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L9">
+      <name>package-three</name>
+      <description>requirements line 9: git+https://github.com/path/to/package-three@0.1#egg=package-three</description>
+      <purl>pkg:pypi/package-three?vcs_url=git%2Bhttps://github.com/path/to/package-three%400.1%23egg%3Dpackage-three</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-three@0.1#egg=package-three</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>package-two</name>
+      <description>requirements line 7: git+https://github.com/path/to/package-two@master#egg=package-two</description>
+      <purl>pkg:pypi/package-two?vcs_url=git%2Bhttps://github.com/path/to/package-two%40master%23egg%3Dpackage-two</purl>
+      <externalReferences>
+        <reference type="vcs">
+          <url>git+https://github.com/path/to/package-two@master#egg=package-two</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L19">
+      <name>unknown</name>
+      <description>requirements line 19: https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</description>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/78/23/f78fd8311e0f710fe1d065d50b92ce0057fe877b8ed7fd41b28ad6865bfc/numpy-1.26.1.tar.gz</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L23">
+      <name>urllib3</name>
+      <description>requirements line 23: urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</description>
+      <purl>pkg:pypi/urllib3?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L15">
+      <name>wxPython-Phoenix</name>
+      <version>3.0.3.dev1820+49a8884</version>
+      <description>requirements line 15: http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</description>
+      <purl>pkg:pypi/wxpython-phoenix@3.0.3.dev1820%2B49a8884?download_url=http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820%2B49a8884-cp34-none-win_amd64.whl</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>http://wxpython.org/Phoenix/snapshot-builds/wxPython_Phoenix-3.0.3.dev1820+49a8884-cp34-none-win_amd64.whl</url>
+          <comment>explicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L11"/>
+    <dependency ref="requirements-L15"/>
+    <dependency ref="requirements-L19"/>
+    <dependency ref="requirements-L23"/>
+    <dependency ref="requirements-L5"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L9"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-file.bin
new file mode 100644
index 00000000..33d1f35d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-file.bin
@@ -0,0 +1,86 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-stream.bin
new file mode 100644
index 00000000..c782828c
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-stream.bin
@@ -0,0 +1,71 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L1",
+      "description": "requirements line 1: certifi>=2021.5.30",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/certifi/"
+        }
+      ],
+      "name": "certifi",
+      "purl": "pkg:pypi/certifi",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L2",
+      "description": "requirements line 2: chardet >= 4.0.0 , < 5",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/chardet/"
+        }
+      ],
+      "name": "chardet",
+      "purl": "pkg:pypi/chardet",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L3",
+      "description": "requirements line 3: urllib3",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/urllib3/"
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L1"
+    },
+    {
+      "ref": "requirements-L2"
+    },
+    {
+      "ref": "requirements-L3"
+    }
+  ],
+  "metadata": {
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-file.bin
new file mode 100644
index 00000000..70437316
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-file.bin
@@ -0,0 +1,93 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
+      <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
+      <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>urllib3</name>
+      <description>requirements line 3: urllib3</description>
+      <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-stream.bin
new file mode 100644
index 00000000..9092c6b6
--- /dev/null
+++ b/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-stream.bin
@@ -0,0 +1,84 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L1">
+      <name>certifi</name>
+      <description>requirements line 1: certifi&gt;=2021.5.30</description>
+      <purl>pkg:pypi/certifi</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/certifi/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L2">
+      <name>chardet</name>
+      <description>requirements line 2: chardet &gt;= 4.0.0 , &lt; 5</description>
+      <purl>pkg:pypi/chardet</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/chardet/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L3">
+      <name>urllib3</name>
+      <description>requirements line 3: urllib3</description>
+      <purl>pkg:pypi/urllib3</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/urllib3/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L1"/>
+    <dependency ref="requirements-L2"/>
+    <dependency ref="requirements-L3"/>
+  </dependencies>
+</bom>

From 3709b43da816e0c877abb9ca6e264e40fc48b454 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Thu, 21 Dec 2023 14:08:39 +0100
Subject: [PATCH 146/155] refactor test snapshots (#630)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 pyproject.toml                                |  5 +-
 ...xml.bin => file_category-deps_1.0.xml.bin} |  0
 ...xml.bin => file_category-deps_1.1.xml.bin} |  0
 ...on.bin => file_category-deps_1.2.json.bin} |  0
 ...xml.bin => file_category-deps_1.2.xml.bin} |  0
 ...on.bin => file_category-deps_1.3.json.bin} |  0
 ...xml.bin => file_category-deps_1.3.xml.bin} |  0
 ...on.bin => file_category-deps_1.4.json.bin} |  0
 ...xml.bin => file_category-deps_1.4.xml.bin} |  0
 ...on.bin => file_category-deps_1.5.json.bin} |  0
 ...xml.bin => file_category-deps_1.5.xml.bin} |  0
 ...l.bin => file_default-and-dev_1.0.xml.bin} |  0
 ...l.bin => file_default-and-dev_1.1.xml.bin} |  0
 ....bin => file_default-and-dev_1.2.json.bin} |  0
 ...l.bin => file_default-and-dev_1.2.xml.bin} |  0
 ....bin => file_default-and-dev_1.3.json.bin} |  0
 ...l.bin => file_default-and-dev_1.3.xml.bin} |  0
 ....bin => file_default-and-dev_1.4.json.bin} |  0
 ...l.bin => file_default-and-dev_1.4.xml.bin} |  0
 ....bin => file_default-and-dev_1.5.json.bin} |  0
 ...l.bin => file_default-and-dev_1.5.xml.bin} |  0
 ...xml.bin => file_editable-self_1.0.xml.bin} |  0
 ...xml.bin => file_editable-self_1.1.xml.bin} |  0
 ...on.bin => file_editable-self_1.2.json.bin} |  0
 ...xml.bin => file_editable-self_1.2.xml.bin} |  0
 ...on.bin => file_editable-self_1.3.json.bin} |  0
 ...xml.bin => file_editable-self_1.3.xml.bin} |  0
 ...on.bin => file_editable-self_1.4.json.bin} |  0
 ...xml.bin => file_editable-self_1.4.xml.bin} |  0
 ...on.bin => file_editable-self_1.5.json.bin} |  0
 ...xml.bin => file_editable-self_1.5.xml.bin} |  0
 ...cal_1.0.xml.bin => file_local_1.0.xml.bin} |  0
 ...cal_1.1.xml.bin => file_local_1.1.xml.bin} |  0
 ...l_1.2.json.bin => file_local_1.2.json.bin} |  0
 ...cal_1.2.xml.bin => file_local_1.2.xml.bin} |  0
 ...l_1.3.json.bin => file_local_1.3.json.bin} |  0
 ...cal_1.3.xml.bin => file_local_1.3.xml.bin} |  0
 ...l_1.4.json.bin => file_local_1.4.json.bin} |  0
 ...cal_1.4.xml.bin => file_local_1.4.xml.bin} |  0
 ...l_1.5.json.bin => file_local_1.5.json.bin} |  0
 ...cal_1.5.xml.bin => file_local_1.5.xml.bin} |  0
 ...s_1.0.xml.bin => file_no-deps_1.0.xml.bin} |  0
 ...s_1.1.xml.bin => file_no-deps_1.1.xml.bin} |  0
 ...1.2.json.bin => file_no-deps_1.2.json.bin} |  0
 ...s_1.2.xml.bin => file_no-deps_1.2.xml.bin} |  0
 ...1.3.json.bin => file_no-deps_1.3.json.bin} |  0
 ...s_1.3.xml.bin => file_no-deps_1.3.xml.bin} |  0
 ...1.4.json.bin => file_no-deps_1.4.json.bin} |  0
 ...s_1.4.xml.bin => file_no-deps_1.4.xml.bin} |  0
 ...1.5.json.bin => file_no-deps_1.5.json.bin} |  0
 ...s_1.5.xml.bin => file_no-deps_1.5.xml.bin} |  0
 ....bin => file_private-packages_1.0.xml.bin} |  0
 ....bin => file_private-packages_1.1.xml.bin} |  0
 ...bin => file_private-packages_1.2.json.bin} |  0
 ....bin => file_private-packages_1.2.xml.bin} |  0
 ...bin => file_private-packages_1.3.json.bin} |  0
 ....bin => file_private-packages_1.3.xml.bin} |  0
 ...bin => file_private-packages_1.4.json.bin} |  0
 ....bin => file_private-packages_1.4.xml.bin} |  0
 ...bin => file_private-packages_1.5.json.bin} |  0
 ....bin => file_private-packages_1.5.xml.bin} |  0
 ...0.xml.bin => file_with-extras_1.0.xml.bin} |  0
 ...1.xml.bin => file_with-extras_1.1.xml.bin} |  0
 ...json.bin => file_with-extras_1.2.json.bin} |  0
 ...2.xml.bin => file_with-extras_1.2.xml.bin} |  0
 ...json.bin => file_with-extras_1.3.json.bin} |  0
 ...3.xml.bin => file_with-extras_1.3.xml.bin} |  0
 ...json.bin => file_with-extras_1.4.json.bin} |  0
 ...4.xml.bin => file_with-extras_1.4.xml.bin} |  0
 ...json.bin => file_with-extras_1.5.json.bin} |  0
 ...5.xml.bin => file_with-extras_1.5.xml.bin} |  0
 ...1.0.xml.bin => file_with-urls_1.0.xml.bin} |  0
 ...1.1.xml.bin => file_with-urls_1.1.xml.bin} |  0
 ...2.json.bin => file_with-urls_1.2.json.bin} |  0
 ...1.2.xml.bin => file_with-urls_1.2.xml.bin} |  0
 ...3.json.bin => file_with-urls_1.3.json.bin} |  0
 ...1.3.xml.bin => file_with-urls_1.3.xml.bin} |  0
 ...4.json.bin => file_with-urls_1.4.json.bin} |  0
 ...1.4.xml.bin => file_with-urls_1.4.xml.bin} |  0
 ...5.json.bin => file_with-urls_1.5.json.bin} |  0
 ...1.5.xml.bin => file_with-urls_1.5.xml.bin} |  0
 ....xml.bin => group-deps_lock11_1.0.xml.bin} |  0
 ....xml.bin => group-deps_lock11_1.1.xml.bin} |  0
 ...son.bin => group-deps_lock11_1.2.json.bin} |  0
 ....xml.bin => group-deps_lock11_1.2.xml.bin} |  0
 ...son.bin => group-deps_lock11_1.3.json.bin} |  0
 ....xml.bin => group-deps_lock11_1.3.xml.bin} |  0
 ...son.bin => group-deps_lock11_1.4.json.bin} |  0
 ....xml.bin => group-deps_lock11_1.4.xml.bin} |  0
 ...son.bin => group-deps_lock11_1.5.json.bin} |  0
 ....xml.bin => group-deps_lock11_1.5.xml.bin} |  0
 ....xml.bin => group-deps_lock20_1.0.xml.bin} |  0
 ....xml.bin => group-deps_lock20_1.1.xml.bin} |  0
 ...son.bin => group-deps_lock20_1.2.json.bin} |  0
 ....xml.bin => group-deps_lock20_1.2.xml.bin} |  0
 ...son.bin => group-deps_lock20_1.3.json.bin} |  0
 ....xml.bin => group-deps_lock20_1.3.xml.bin} |  0
 ...son.bin => group-deps_lock20_1.4.json.bin} |  0
 ....xml.bin => group-deps_lock20_1.4.xml.bin} |  0
 ...son.bin => group-deps_lock20_1.5.json.bin} |  0
 ....xml.bin => group-deps_lock20_1.5.xml.bin} |  0
 ...0-1.0.xml.bin => local_lock10_1.0.xml.bin} |  0
 ...0-1.1.xml.bin => local_lock10_1.1.xml.bin} |  0
 ...1.2.json.bin => local_lock10_1.2.json.bin} |  0
 ...0-1.2.xml.bin => local_lock10_1.2.xml.bin} |  0
 ...1.3.json.bin => local_lock10_1.3.json.bin} |  0
 ...0-1.3.xml.bin => local_lock10_1.3.xml.bin} |  0
 ...1.4.json.bin => local_lock10_1.4.json.bin} |  0
 ...0-1.4.xml.bin => local_lock10_1.4.xml.bin} |  0
 ...1.5.json.bin => local_lock10_1.5.json.bin} |  0
 ...0-1.5.xml.bin => local_lock10_1.5.xml.bin} |  0
 ...1-1.0.xml.bin => local_lock11_1.0.xml.bin} |  0
 ...1-1.1.xml.bin => local_lock11_1.1.xml.bin} |  0
 ...1.2.json.bin => local_lock11_1.2.json.bin} |  0
 ...1-1.2.xml.bin => local_lock11_1.2.xml.bin} |  0
 ...1.3.json.bin => local_lock11_1.3.json.bin} |  0
 ...1-1.3.xml.bin => local_lock11_1.3.xml.bin} |  0
 ...1.4.json.bin => local_lock11_1.4.json.bin} |  0
 ...1-1.4.xml.bin => local_lock11_1.4.xml.bin} |  0
 ...1.5.json.bin => local_lock11_1.5.json.bin} |  0
 ...1-1.5.xml.bin => local_lock11_1.5.xml.bin} |  0
 ...0-1.0.xml.bin => local_lock20_1.0.xml.bin} |  0
 ...0-1.1.xml.bin => local_lock20_1.1.xml.bin} |  0
 ...1.2.json.bin => local_lock20_1.2.json.bin} |  0
 ...0-1.2.xml.bin => local_lock20_1.2.xml.bin} |  0
 ...1.3.json.bin => local_lock20_1.3.json.bin} |  0
 ...0-1.3.xml.bin => local_lock20_1.3.xml.bin} |  0
 ...1.4.json.bin => local_lock20_1.4.json.bin} |  0
 ...0-1.4.xml.bin => local_lock20_1.4.xml.bin} |  0
 ...1.5.json.bin => local_lock20_1.5.json.bin} |  0
 ...0-1.5.xml.bin => local_lock20_1.5.xml.bin} |  0
 ...ml.bin => main-and-dev_lock10_1.0.xml.bin} |  0
 ...ml.bin => main-and-dev_lock10_1.1.xml.bin} |  0
 ...n.bin => main-and-dev_lock10_1.2.json.bin} |  0
 ...ml.bin => main-and-dev_lock10_1.2.xml.bin} |  0
 ...n.bin => main-and-dev_lock10_1.3.json.bin} |  0
 ...ml.bin => main-and-dev_lock10_1.3.xml.bin} |  0
 ...n.bin => main-and-dev_lock10_1.4.json.bin} |  0
 ...ml.bin => main-and-dev_lock10_1.4.xml.bin} |  0
 ...n.bin => main-and-dev_lock10_1.5.json.bin} |  0
 ...ml.bin => main-and-dev_lock10_1.5.xml.bin} |  0
 ...ml.bin => main-and-dev_lock11_1.0.xml.bin} |  0
 ...ml.bin => main-and-dev_lock11_1.1.xml.bin} |  0
 ...n.bin => main-and-dev_lock11_1.2.json.bin} |  0
 ...ml.bin => main-and-dev_lock11_1.2.xml.bin} |  0
 ...n.bin => main-and-dev_lock11_1.3.json.bin} |  0
 ...ml.bin => main-and-dev_lock11_1.3.xml.bin} |  0
 ...n.bin => main-and-dev_lock11_1.4.json.bin} |  0
 ...ml.bin => main-and-dev_lock11_1.4.xml.bin} |  0
 ...n.bin => main-and-dev_lock11_1.5.json.bin} |  0
 ...ml.bin => main-and-dev_lock11_1.5.xml.bin} |  0
 ...ml.bin => main-and-dev_lock20_1.0.xml.bin} |  0
 ...ml.bin => main-and-dev_lock20_1.1.xml.bin} |  0
 ...n.bin => main-and-dev_lock20_1.2.json.bin} |  0
 ...ml.bin => main-and-dev_lock20_1.2.xml.bin} |  0
 ...n.bin => main-and-dev_lock20_1.3.json.bin} |  0
 ...ml.bin => main-and-dev_lock20_1.3.xml.bin} |  0
 ...n.bin => main-and-dev_lock20_1.4.json.bin} |  0
 ...ml.bin => main-and-dev_lock20_1.4.xml.bin} |  0
 ...n.bin => main-and-dev_lock20_1.5.json.bin} |  0
 ...ml.bin => main-and-dev_lock20_1.5.xml.bin} |  0
 ...1.0.xml.bin => no-deps_lock20_1.0.xml.bin} |  0
 ...1.1.xml.bin => no-deps_lock20_1.1.xml.bin} |  0
 ...2.json.bin => no-deps_lock20_1.2.json.bin} |  0
 ...1.2.xml.bin => no-deps_lock20_1.2.xml.bin} |  0
 ...3.json.bin => no-deps_lock20_1.3.json.bin} |  0
 ...1.3.xml.bin => no-deps_lock20_1.3.xml.bin} |  0
 ...4.json.bin => no-deps_lock20_1.4.json.bin} |  0
 ...1.4.xml.bin => no-deps_lock20_1.4.xml.bin} |  0
 ...5.json.bin => no-deps_lock20_1.5.json.bin} |  0
 ...1.5.xml.bin => no-deps_lock20_1.5.xml.bin} |  0
 ...-1.0.xml.bin => no-dev_lock11_1.0.xml.bin} |  0
 ...-1.1.xml.bin => no-dev_lock11_1.1.xml.bin} |  0
 ....2.json.bin => no-dev_lock11_1.2.json.bin} |  0
 ...-1.2.xml.bin => no-dev_lock11_1.2.xml.bin} |  0
 ....3.json.bin => no-dev_lock11_1.3.json.bin} |  0
 ...-1.3.xml.bin => no-dev_lock11_1.3.xml.bin} |  0
 ....4.json.bin => no-dev_lock11_1.4.json.bin} |  0
 ...-1.4.xml.bin => no-dev_lock11_1.4.xml.bin} |  0
 ....5.json.bin => no-dev_lock11_1.5.json.bin} |  0
 ...-1.5.xml.bin => no-dev_lock11_1.5.xml.bin} |  0
 ...-1.0.xml.bin => no-dev_lock20_1.0.xml.bin} |  0
 ...-1.1.xml.bin => no-dev_lock20_1.1.xml.bin} |  0
 ....2.json.bin => no-dev_lock20_1.2.json.bin} |  0
 ...-1.2.xml.bin => no-dev_lock20_1.2.xml.bin} |  0
 ....3.json.bin => no-dev_lock20_1.3.json.bin} |  0
 ...-1.3.xml.bin => no-dev_lock20_1.3.xml.bin} |  0
 ....4.json.bin => no-dev_lock20_1.4.json.bin} |  0
 ...-1.4.xml.bin => no-dev_lock20_1.4.xml.bin} |  0
 ....5.json.bin => no-dev_lock20_1.5.json.bin} |  0
 ...-1.5.xml.bin => no-dev_lock20_1.5.xml.bin} |  0
 ...xml.bin => only-groups_lock11_1.0.xml.bin} |  0
 ...xml.bin => only-groups_lock11_1.1.xml.bin} |  0
 ...on.bin => only-groups_lock11_1.2.json.bin} |  0
 ...xml.bin => only-groups_lock11_1.2.xml.bin} |  0
 ...on.bin => only-groups_lock11_1.3.json.bin} |  0
 ...xml.bin => only-groups_lock11_1.3.xml.bin} |  0
 ...on.bin => only-groups_lock11_1.4.json.bin} |  0
 ...xml.bin => only-groups_lock11_1.4.xml.bin} |  0
 ...on.bin => only-groups_lock11_1.5.json.bin} |  0
 ...xml.bin => only-groups_lock11_1.5.xml.bin} |  0
 ...xml.bin => only-groups_lock20_1.0.xml.bin} |  0
 ...xml.bin => only-groups_lock20_1.1.xml.bin} |  0
 ...on.bin => only-groups_lock20_1.2.json.bin} |  0
 ...xml.bin => only-groups_lock20_1.2.xml.bin} |  0
 ...on.bin => only-groups_lock20_1.3.json.bin} |  0
 ...xml.bin => only-groups_lock20_1.3.xml.bin} |  0
 ...on.bin => only-groups_lock20_1.4.json.bin} |  0
 ...xml.bin => only-groups_lock20_1.4.xml.bin} |  0
 ...on.bin => only-groups_lock20_1.5.json.bin} |  0
 ...xml.bin => only-groups_lock20_1.5.xml.bin} |  0
 ...bin => private-packges_lock10_1.0.xml.bin} |  0
 ...bin => private-packges_lock10_1.1.xml.bin} |  0
 ...in => private-packges_lock10_1.2.json.bin} |  0
 ...bin => private-packges_lock10_1.2.xml.bin} |  0
 ...in => private-packges_lock10_1.3.json.bin} |  0
 ...bin => private-packges_lock10_1.3.xml.bin} |  0
 ...in => private-packges_lock10_1.4.json.bin} |  0
 ...bin => private-packges_lock10_1.4.xml.bin} |  0
 ...in => private-packges_lock10_1.5.json.bin} |  0
 ...bin => private-packges_lock10_1.5.xml.bin} |  0
 ...bin => private-packges_lock11_1.0.xml.bin} |  0
 ...bin => private-packges_lock11_1.1.xml.bin} |  0
 ...in => private-packges_lock11_1.2.json.bin} |  0
 ...bin => private-packges_lock11_1.2.xml.bin} |  0
 ...in => private-packges_lock11_1.3.json.bin} |  0
 ...bin => private-packges_lock11_1.3.xml.bin} |  0
 ...in => private-packges_lock11_1.4.json.bin} |  0
 ...bin => private-packges_lock11_1.4.xml.bin} |  0
 ...in => private-packges_lock11_1.5.json.bin} |  0
 ...bin => private-packges_lock11_1.5.xml.bin} |  0
 ...bin => private-packges_lock20_1.0.xml.bin} |  0
 ...bin => private-packges_lock20_1.1.xml.bin} |  0
 ...in => private-packges_lock20_1.2.json.bin} |  0
 ...bin => private-packges_lock20_1.2.xml.bin} |  0
 ...in => private-packges_lock20_1.3.json.bin} |  0
 ...bin => private-packges_lock20_1.3.xml.bin} |  0
 ...in => private-packges_lock20_1.4.json.bin} |  0
 ...bin => private-packges_lock20_1.4.xml.bin} |  0
 ...in => private-packges_lock20_1.5.json.bin} |  0
 ...bin => private-packges_lock20_1.5.xml.bin} |  0
 ...=> regression-issue611_lock20_1.0.xml.bin} |  0
 ...=> regression-issue611_lock20_1.1.xml.bin} |  0
 ...> regression-issue611_lock20_1.2.json.bin} |  0
 ...=> regression-issue611_lock20_1.2.xml.bin} |  0
 ...> regression-issue611_lock20_1.3.json.bin} |  0
 ...=> regression-issue611_lock20_1.3.xml.bin} |  0
 ...> regression-issue611_lock20_1.4.json.bin} |  0
 ...=> regression-issue611_lock20_1.4.xml.bin} |  0
 ...> regression-issue611_lock20_1.5.json.bin} |  0
 ...=> regression-issue611_lock20_1.5.xml.bin} |  0
 ...xml.bin => some-extras_lock10_1.0.xml.bin} |  0
 ...xml.bin => some-extras_lock10_1.1.xml.bin} |  0
 ...on.bin => some-extras_lock10_1.2.json.bin} |  0
 ...xml.bin => some-extras_lock10_1.2.xml.bin} |  0
 ...on.bin => some-extras_lock10_1.3.json.bin} |  0
 ...xml.bin => some-extras_lock10_1.3.xml.bin} |  0
 ...on.bin => some-extras_lock10_1.4.json.bin} |  0
 ...xml.bin => some-extras_lock10_1.4.xml.bin} |  0
 ...on.bin => some-extras_lock10_1.5.json.bin} |  0
 ...xml.bin => some-extras_lock10_1.5.xml.bin} |  0
 ...xml.bin => some-extras_lock11_1.0.xml.bin} |  0
 ...xml.bin => some-extras_lock11_1.1.xml.bin} |  0
 ...on.bin => some-extras_lock11_1.2.json.bin} |  0
 ...xml.bin => some-extras_lock11_1.2.xml.bin} |  0
 ...on.bin => some-extras_lock11_1.3.json.bin} |  0
 ...xml.bin => some-extras_lock11_1.3.xml.bin} |  0
 ...on.bin => some-extras_lock11_1.4.json.bin} |  0
 ...xml.bin => some-extras_lock11_1.4.xml.bin} |  0
 ...on.bin => some-extras_lock11_1.5.json.bin} |  0
 ...xml.bin => some-extras_lock11_1.5.xml.bin} |  0
 ...xml.bin => some-extras_lock20_1.0.xml.bin} |  0
 ...xml.bin => some-extras_lock20_1.1.xml.bin} |  0
 ...on.bin => some-extras_lock20_1.2.json.bin} |  0
 ...xml.bin => some-extras_lock20_1.2.xml.bin} |  0
 ...on.bin => some-extras_lock20_1.3.json.bin} |  0
 ...xml.bin => some-extras_lock20_1.3.xml.bin} |  0
 ...on.bin => some-extras_lock20_1.4.json.bin} |  0
 ...xml.bin => some-extras_lock20_1.4.xml.bin} |  0
 ...on.bin => some-extras_lock20_1.5.json.bin} |  0
 ...xml.bin => some-extras_lock20_1.5.xml.bin} |  0
 ...xml.bin => some-groups_lock11_1.0.xml.bin} |  0
 ...xml.bin => some-groups_lock11_1.1.xml.bin} |  0
 ...on.bin => some-groups_lock11_1.2.json.bin} |  0
 ...xml.bin => some-groups_lock11_1.2.xml.bin} |  0
 ...on.bin => some-groups_lock11_1.3.json.bin} |  0
 ...xml.bin => some-groups_lock11_1.3.xml.bin} |  0
 ...on.bin => some-groups_lock11_1.4.json.bin} |  0
 ...xml.bin => some-groups_lock11_1.4.xml.bin} |  0
 ...on.bin => some-groups_lock11_1.5.json.bin} |  0
 ...xml.bin => some-groups_lock11_1.5.xml.bin} |  0
 ...xml.bin => some-groups_lock20_1.0.xml.bin} |  0
 ...xml.bin => some-groups_lock20_1.1.xml.bin} |  0
 ...on.bin => some-groups_lock20_1.2.json.bin} |  0
 ...xml.bin => some-groups_lock20_1.2.xml.bin} |  0
 ...on.bin => some-groups_lock20_1.3.json.bin} |  0
 ...xml.bin => some-groups_lock20_1.3.xml.bin} |  0
 ...on.bin => some-groups_lock20_1.4.json.bin} |  0
 ...xml.bin => some-groups_lock20_1.4.xml.bin} |  0
 ...on.bin => some-groups_lock20_1.5.json.bin} |  0
 ...xml.bin => some-groups_lock20_1.5.xml.bin} |  0
 ...xml.bin => with-extras_lock10_1.0.xml.bin} |  0
 ...xml.bin => with-extras_lock10_1.1.xml.bin} |  0
 ...on.bin => with-extras_lock10_1.2.json.bin} |  0
 ...xml.bin => with-extras_lock10_1.2.xml.bin} |  0
 ...on.bin => with-extras_lock10_1.3.json.bin} |  0
 ...xml.bin => with-extras_lock10_1.3.xml.bin} |  0
 ...on.bin => with-extras_lock10_1.4.json.bin} |  0
 ...xml.bin => with-extras_lock10_1.4.xml.bin} |  0
 ...on.bin => with-extras_lock10_1.5.json.bin} |  0
 ...xml.bin => with-extras_lock10_1.5.xml.bin} |  0
 ...xml.bin => with-extras_lock11_1.0.xml.bin} |  0
 ...xml.bin => with-extras_lock11_1.1.xml.bin} |  0
 ...on.bin => with-extras_lock11_1.2.json.bin} |  0
 ...xml.bin => with-extras_lock11_1.2.xml.bin} |  0
 ...on.bin => with-extras_lock11_1.3.json.bin} |  0
 ...xml.bin => with-extras_lock11_1.3.xml.bin} |  0
 ...on.bin => with-extras_lock11_1.4.json.bin} |  0
 ...xml.bin => with-extras_lock11_1.4.xml.bin} |  0
 ...on.bin => with-extras_lock11_1.5.json.bin} |  0
 ...xml.bin => with-extras_lock11_1.5.xml.bin} |  0
 ...xml.bin => with-extras_lock20_1.0.xml.bin} |  0
 ...xml.bin => with-extras_lock20_1.1.xml.bin} |  0
 ...on.bin => with-extras_lock20_1.2.json.bin} |  0
 ...xml.bin => with-extras_lock20_1.2.xml.bin} |  0
 ...on.bin => with-extras_lock20_1.3.json.bin} |  0
 ...xml.bin => with-extras_lock20_1.3.xml.bin} |  0
 ...on.bin => with-extras_lock20_1.4.json.bin} |  0
 ...xml.bin => with-extras_lock20_1.4.xml.bin} |  0
 ...on.bin => with-extras_lock20_1.5.json.bin} |  0
 ...xml.bin => with-extras_lock20_1.5.xml.bin} |  0
 ...0.xml.bin => with-urls_lock10_1.0.xml.bin} |  0
 ...1.xml.bin => with-urls_lock10_1.1.xml.bin} |  0
 ...json.bin => with-urls_lock10_1.2.json.bin} |  0
 ...2.xml.bin => with-urls_lock10_1.2.xml.bin} |  0
 ...json.bin => with-urls_lock10_1.3.json.bin} |  0
 ...3.xml.bin => with-urls_lock10_1.3.xml.bin} |  0
 ...json.bin => with-urls_lock10_1.4.json.bin} |  0
 ...4.xml.bin => with-urls_lock10_1.4.xml.bin} |  0
 ...json.bin => with-urls_lock10_1.5.json.bin} |  0
 ...5.xml.bin => with-urls_lock10_1.5.xml.bin} |  0
 ...0.xml.bin => with-urls_lock11_1.0.xml.bin} |  0
 ...1.xml.bin => with-urls_lock11_1.1.xml.bin} |  0
 ...json.bin => with-urls_lock11_1.2.json.bin} |  0
 ...2.xml.bin => with-urls_lock11_1.2.xml.bin} |  0
 ...json.bin => with-urls_lock11_1.3.json.bin} |  0
 ...3.xml.bin => with-urls_lock11_1.3.xml.bin} |  0
 ...json.bin => with-urls_lock11_1.4.json.bin} |  0
 ...4.xml.bin => with-urls_lock11_1.4.xml.bin} |  0
 ...json.bin => with-urls_lock11_1.5.json.bin} |  0
 ...5.xml.bin => with-urls_lock11_1.5.xml.bin} |  0
 ...0.xml.bin => with-urls_lock20_1.0.xml.bin} |  0
 ...1.xml.bin => with-urls_lock20_1.1.xml.bin} |  0
 ...json.bin => with-urls_lock20_1.2.json.bin} |  0
 ...2.xml.bin => with-urls_lock20_1.2.xml.bin} |  0
 ...json.bin => with-urls_lock20_1.3.json.bin} |  0
 ...3.xml.bin => with-urls_lock20_1.3.xml.bin} |  0
 ...json.bin => with-urls_lock20_1.4.json.bin} |  0
 ...4.xml.bin => with-urls_lock20_1.4.xml.bin} |  0
 ...json.bin => with-urls_lock20_1.5.json.bin} |  0
 ...5.xml.bin => with-urls_lock20_1.5.xml.bin} |  0
 ...0.xml-file.bin => file_frozen_1.0.xml.bin} |  0
 ...1.xml-file.bin => file_frozen_1.1.xml.bin} |  0
 ...json-file.bin => file_frozen_1.2.json.bin} |  0
 ...2.xml-file.bin => file_frozen_1.2.xml.bin} |  0
 ...json-file.bin => file_frozen_1.3.json.bin} |  0
 ...3.xml-file.bin => file_frozen_1.3.xml.bin} |  0
 ...json-file.bin => file_frozen_1.4.json.bin} |  0
 ...4.xml-file.bin => file_frozen_1.4.xml.bin} |  0
 ...json-file.bin => file_frozen_1.5.json.bin} |  0
 ...5.xml-file.bin => file_frozen_1.5.xml.bin} |  0
 ....0.xml-file.bin => file_local_1.0.xml.bin} |  0
 ....1.xml-file.bin => file_local_1.1.xml.bin} |  0
 ....json-file.bin => file_local_1.2.json.bin} |  0
 ....2.xml-file.bin => file_local_1.2.xml.bin} |  0
 ....json-file.bin => file_local_1.3.json.bin} |  0
 ....3.xml-file.bin => file_local_1.3.xml.bin} |  0
 ....json-file.bin => file_local_1.4.json.bin} |  0
 ....4.xml-file.bin => file_local_1.4.xml.bin} |  0
 ....json-file.bin => file_local_1.5.json.bin} |  0
 ....5.xml-file.bin => file_local_1.5.xml.bin} |  0
 ...xml-stream.bin => file_nested_1.0.xml.bin} |  0
 ...xml-stream.bin => file_nested_1.1.xml.bin} |  0
 ...json-file.bin => file_nested_1.2.json.bin} |  0
 ...2.xml-file.bin => file_nested_1.2.xml.bin} |  0
 ...json-file.bin => file_nested_1.3.json.bin} |  0
 ...3.xml-file.bin => file_nested_1.3.xml.bin} |  0
 ...json-file.bin => file_nested_1.4.json.bin} |  0
 ...4.xml-file.bin => file_nested_1.4.xml.bin} |  0
 ...json-file.bin => file_nested_1.5.json.bin} |  0
 ...5.xml-file.bin => file_nested_1.5.xml.bin} |  0
 ....bin => file_private-packages_1.0.xml.bin} |  0
 ....bin => file_private-packages_1.1.xml.bin} |  0
 ...bin => file_private-packages_1.2.json.bin} |  0
 ....bin => file_private-packages_1.2.xml.bin} |  0
 ...bin => file_private-packages_1.3.json.bin} |  0
 ....bin => file_private-packages_1.3.xml.bin} |  0
 ...bin => file_private-packages_1.4.json.bin} |  0
 ....bin => file_private-packages_1.4.xml.bin} |  0
 ...bin => file_private-packages_1.5.json.bin} |  0
 ....bin => file_private-packages_1.5.xml.bin} |  0
 ...egression-issue448.cp1252.txt_1.0.xml.bin} |  0
 ...egression-issue448.cp1252.txt_1.1.xml.bin} |  0
 ...gression-issue448.cp1252.txt_1.2.json.bin} |  0
 ...egression-issue448.cp1252.txt_1.2.xml.bin} |  0
 ...gression-issue448.cp1252.txt_1.3.json.bin} |  0
 ...egression-issue448.cp1252.txt_1.3.xml.bin} |  0
 ...gression-issue448.cp1252.txt_1.4.json.bin} |  0
 ...egression-issue448.cp1252.txt_1.4.xml.bin} |  0
 ...egression-issue448.cp1252.txt_1.5.json.bin | 86 +++++++++++++++++
 ...regression-issue448.cp1252.txt_1.5.xml.bin | 93 +++++++++++++++++++
 ...ile.bin => file_with-comments_1.0.xml.bin} |  0
 ...ile.bin => file_with-comments_1.1.xml.bin} |  0
 ...le.bin => file_with-comments_1.2.json.bin} |  0
 ...ile.bin => file_with-comments_1.2.xml.bin} |  0
 ...le.bin => file_with-comments_1.3.json.bin} |  0
 ...ile.bin => file_with-comments_1.3.xml.bin} |  0
 ...le.bin => file_with-comments_1.4.json.bin} |  0
 ...ile.bin => file_with-comments_1.4.xml.bin} |  0
 ...le.bin => file_with-comments_1.5.json.bin} |  0
 ...ile.bin => file_with-comments_1.5.xml.bin} |  0
 ...-file.bin => file_with-extras_1.0.xml.bin} |  0
 ...-file.bin => file_with-extras_1.1.xml.bin} |  0
 ...file.bin => file_with-extras_1.2.json.bin} |  0
 ...-file.bin => file_with-extras_1.2.xml.bin} |  0
 ...file.bin => file_with-extras_1.3.json.bin} |  0
 ...-file.bin => file_with-extras_1.3.xml.bin} |  0
 ...file.bin => file_with-extras_1.4.json.bin} |  0
 ...-file.bin => file_with-extras_1.4.xml.bin} |  0
 ...file.bin => file_with-extras_1.5.json.bin} |  0
 ...-file.bin => file_with-extras_1.5.xml.bin} |  0
 ...-file.bin => file_with-hashes_1.0.xml.bin} |  0
 ...-file.bin => file_with-hashes_1.1.xml.bin} |  0
 ...file.bin => file_with-hashes_1.2.json.bin} |  0
 ...-file.bin => file_with-hashes_1.2.xml.bin} |  0
 ...file.bin => file_with-hashes_1.3.json.bin} |  0
 ...-file.bin => file_with-hashes_1.3.xml.bin} |  0
 ...file.bin => file_with-hashes_1.4.json.bin} |  0
 ...-file.bin => file_with-hashes_1.4.xml.bin} |  0
 ...file.bin => file_with-hashes_1.5.json.bin} |  0
 ...-file.bin => file_with-hashes_1.5.xml.bin} |  0
 ...ml-file.bin => file_with-urls_1.0.xml.bin} |  0
 ...ml-file.bin => file_with-urls_1.1.xml.bin} |  0
 ...n-file.bin => file_with-urls_1.2.json.bin} |  0
 ...ml-file.bin => file_with-urls_1.2.xml.bin} |  0
 ...n-file.bin => file_with-urls_1.3.json.bin} |  0
 ...ml-file.bin => file_with-urls_1.3.xml.bin} |  0
 ...n-file.bin => file_with-urls_1.4.json.bin} |  0
 ...ml-file.bin => file_with-urls_1.4.xml.bin} |  0
 ...n-file.bin => file_with-urls_1.5.json.bin} |  0
 ...ml-file.bin => file_with-urls_1.5.xml.bin} |  0
 ... file_without-pinned-versions_1.0.xml.bin} |  0
 ... file_without-pinned-versions_1.1.xml.bin} |  0
 ...file_without-pinned-versions_1.2.json.bin} |  0
 ... file_without-pinned-versions_1.2.xml.bin} |  0
 ...file_without-pinned-versions_1.3.json.bin} |  0
 ... file_without-pinned-versions_1.3.xml.bin} |  0
 ...file_without-pinned-versions_1.4.json.bin} |  0
 ... file_without-pinned-versions_1.4.xml.bin} |  0
 ...file_without-pinned-versions_1.5.json.bin} |  0
 ... file_without-pinned-versions_1.5.xml.bin} |  0
 ...xml-file.bin => stream_frozen_1.0.xml.bin} |  0
 ...xml-file.bin => stream_frozen_1.1.xml.bin} |  0
 ...-stream.bin => stream_frozen_1.2.json.bin} |  0
 ...l-stream.bin => stream_frozen_1.2.xml.bin} |  0
 ...-stream.bin => stream_frozen_1.3.json.bin} |  0
 ...l-stream.bin => stream_frozen_1.3.xml.bin} |  0
 ...-stream.bin => stream_frozen_1.4.json.bin} |  0
 ...l-stream.bin => stream_frozen_1.4.xml.bin} |  0
 ...-stream.bin => stream_frozen_1.5.json.bin} |  0
 ...l-stream.bin => stream_frozen_1.5.xml.bin} |  0
 ...ml-stream.bin => stream_local_1.0.xml.bin} |  0
 ...ml-stream.bin => stream_local_1.1.xml.bin} |  0
 ...n-stream.bin => stream_local_1.2.json.bin} |  0
 ...ml-stream.bin => stream_local_1.2.xml.bin} |  0
 ...n-stream.bin => stream_local_1.3.json.bin} |  0
 ...ml-stream.bin => stream_local_1.3.xml.bin} |  0
 ...n-stream.bin => stream_local_1.4.json.bin} |  0
 ...ml-stream.bin => stream_local_1.4.xml.bin} |  0
 ...n-stream.bin => stream_local_1.5.json.bin} |  0
 ...ml-stream.bin => stream_local_1.5.xml.bin} |  0
 ...l-stream.bin => stream_nested_1.0.xml.bin} |  0
 ...l-stream.bin => stream_nested_1.1.xml.bin} |  0
 ...-stream.bin => stream_nested_1.2.json.bin} |  0
 ...l-stream.bin => stream_nested_1.2.xml.bin} |  0
 ...-stream.bin => stream_nested_1.3.json.bin} |  0
 ...l-stream.bin => stream_nested_1.3.xml.bin} |  0
 ...-stream.bin => stream_nested_1.4.json.bin} |  0
 ...l-stream.bin => stream_nested_1.4.xml.bin} |  0
 ...-stream.bin => stream_nested_1.5.json.bin} |  0
 ...l-stream.bin => stream_nested_1.5.xml.bin} |  0
 ...in => stream_private-packages_1.0.xml.bin} |  0
 ...in => stream_private-packages_1.1.xml.bin} |  0
 ...n => stream_private-packages_1.2.json.bin} |  0
 ...in => stream_private-packages_1.2.xml.bin} |  0
 ...n => stream_private-packages_1.3.json.bin} |  0
 ...in => stream_private-packages_1.3.xml.bin} |  0
 ...n => stream_private-packages_1.4.json.bin} |  0
 ...in => stream_private-packages_1.4.xml.bin} |  0
 ...n => stream_private-packages_1.5.json.bin} |  0
 ...in => stream_private-packages_1.5.xml.bin} |  0
 ...egression-issue448.cp1252.txt_1.0.xml.bin} |  0
 ...egression-issue448.cp1252.txt_1.1.xml.bin} |  0
 ...gression-issue448.cp1252.txt_1.2.json.bin} |  0
 ...egression-issue448.cp1252.txt_1.2.xml.bin} |  0
 ...gression-issue448.cp1252.txt_1.3.json.bin} |  0
 ...egression-issue448.cp1252.txt_1.3.xml.bin} |  0
 ...gression-issue448.cp1252.txt_1.4.json.bin} |  0
 ...egression-issue448.cp1252.txt_1.4.xml.bin} |  0
 ...gression-issue448.cp1252.txt_1.5.json.bin} |  0
 ...egression-issue448.cp1252.txt_1.5.xml.bin} |  0
 ...m.bin => stream_with-comments_1.0.xml.bin} |  0
 ...m.bin => stream_with-comments_1.1.xml.bin} |  0
 ....bin => stream_with-comments_1.2.json.bin} |  0
 ...m.bin => stream_with-comments_1.2.xml.bin} |  0
 ....bin => stream_with-comments_1.3.json.bin} |  0
 ...m.bin => stream_with-comments_1.3.xml.bin} |  0
 ....bin => stream_with-comments_1.4.json.bin} |  0
 ...m.bin => stream_with-comments_1.4.xml.bin} |  0
 ....bin => stream_with-comments_1.5.json.bin} |  0
 ...m.bin => stream_with-comments_1.5.xml.bin} |  0
 ...eam.bin => stream_with-extras_1.0.xml.bin} |  0
 ...eam.bin => stream_with-extras_1.1.xml.bin} |  0
 ...am.bin => stream_with-extras_1.2.json.bin} |  0
 ...eam.bin => stream_with-extras_1.2.xml.bin} |  0
 ...am.bin => stream_with-extras_1.3.json.bin} |  0
 ...eam.bin => stream_with-extras_1.3.xml.bin} |  0
 ...am.bin => stream_with-extras_1.4.json.bin} |  0
 ...eam.bin => stream_with-extras_1.4.xml.bin} |  0
 ...am.bin => stream_with-extras_1.5.json.bin} |  0
 ...eam.bin => stream_with-extras_1.5.xml.bin} |  0
 ...eam.bin => stream_with-hashes_1.0.xml.bin} |  0
 ...eam.bin => stream_with-hashes_1.1.xml.bin} |  0
 ...am.bin => stream_with-hashes_1.2.json.bin} |  0
 ...eam.bin => stream_with-hashes_1.2.xml.bin} |  0
 ...am.bin => stream_with-hashes_1.3.json.bin} |  0
 ...eam.bin => stream_with-hashes_1.3.xml.bin} |  0
 ...am.bin => stream_with-hashes_1.4.json.bin} |  0
 ...eam.bin => stream_with-hashes_1.4.xml.bin} |  0
 ...am.bin => stream_with-hashes_1.5.json.bin} |  0
 ...eam.bin => stream_with-hashes_1.5.xml.bin} |  0
 ...tream.bin => stream_with-urls_1.0.xml.bin} |  0
 ...tream.bin => stream_with-urls_1.1.xml.bin} |  0
 ...ream.bin => stream_with-urls_1.2.json.bin} |  0
 ...tream.bin => stream_with-urls_1.2.xml.bin} |  0
 ...ream.bin => stream_with-urls_1.3.json.bin} |  0
 ...tream.bin => stream_with-urls_1.3.xml.bin} |  0
 ...ream.bin => stream_with-urls_1.4.json.bin} |  0
 ...tream.bin => stream_with-urls_1.4.xml.bin} |  0
 ...ream.bin => stream_with-urls_1.5.json.bin} |  0
 ...tream.bin => stream_with-urls_1.5.xml.bin} |  0
 ...tream_without-pinned-versions_1.0.xml.bin} |  0
 ...tream_without-pinned-versions_1.1.xml.bin} |  0
 ...ream_without-pinned-versions_1.2.json.bin} |  0
 ...tream_without-pinned-versions_1.2.xml.bin} |  0
 ...ream_without-pinned-versions_1.3.json.bin} |  0
 ...tream_without-pinned-versions_1.3.xml.bin} |  0
 ...ream_without-pinned-versions_1.4.json.bin} |  0
 ...tream_without-pinned-versions_1.4.xml.bin} |  0
 ...ream_without-pinned-versions_1.5.json.bin} |  0
 ...tream_without-pinned-versions_1.5.xml.bin} |  0
 tests/integration/test_pipenv.py              | 32 +++----
 tests/integration/test_poetry.py              | 34 ++++---
 tests/integration/test_requirements.py        | 26 +++---
 564 files changed, 229 insertions(+), 47 deletions(-)
 rename tests/_data/snapshots/pipenv/{category-deps_1.0.xml.bin => file_category-deps_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.1.xml.bin => file_category-deps_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.2.json.bin => file_category-deps_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.2.xml.bin => file_category-deps_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.3.json.bin => file_category-deps_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.3.xml.bin => file_category-deps_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.4.json.bin => file_category-deps_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.4.xml.bin => file_category-deps_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.5.json.bin => file_category-deps_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{category-deps_1.5.xml.bin => file_category-deps_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.0.xml.bin => file_default-and-dev_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.1.xml.bin => file_default-and-dev_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.2.json.bin => file_default-and-dev_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.2.xml.bin => file_default-and-dev_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.3.json.bin => file_default-and-dev_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.3.xml.bin => file_default-and-dev_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.4.json.bin => file_default-and-dev_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.4.xml.bin => file_default-and-dev_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.5.json.bin => file_default-and-dev_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{default-and-dev_1.5.xml.bin => file_default-and-dev_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.0.xml.bin => file_editable-self_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.1.xml.bin => file_editable-self_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.2.json.bin => file_editable-self_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.2.xml.bin => file_editable-self_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.3.json.bin => file_editable-self_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.3.xml.bin => file_editable-self_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.4.json.bin => file_editable-self_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.4.xml.bin => file_editable-self_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.5.json.bin => file_editable-self_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{editable-self_1.5.xml.bin => file_editable-self_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.0.xml.bin => file_local_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.1.xml.bin => file_local_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.2.json.bin => file_local_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.2.xml.bin => file_local_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.3.json.bin => file_local_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.3.xml.bin => file_local_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.4.json.bin => file_local_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.4.xml.bin => file_local_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.5.json.bin => file_local_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{local_1.5.xml.bin => file_local_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.0.xml.bin => file_no-deps_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.1.xml.bin => file_no-deps_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.2.json.bin => file_no-deps_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.2.xml.bin => file_no-deps_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.3.json.bin => file_no-deps_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.3.xml.bin => file_no-deps_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.4.json.bin => file_no-deps_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.4.xml.bin => file_no-deps_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.5.json.bin => file_no-deps_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{no-deps_1.5.xml.bin => file_no-deps_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.0.xml.bin => file_private-packages_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.1.xml.bin => file_private-packages_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.2.json.bin => file_private-packages_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.2.xml.bin => file_private-packages_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.3.json.bin => file_private-packages_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.3.xml.bin => file_private-packages_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.4.json.bin => file_private-packages_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.4.xml.bin => file_private-packages_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.5.json.bin => file_private-packages_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{private-packages_1.5.xml.bin => file_private-packages_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.0.xml.bin => file_with-extras_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.1.xml.bin => file_with-extras_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.2.json.bin => file_with-extras_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.2.xml.bin => file_with-extras_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.3.json.bin => file_with-extras_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.3.xml.bin => file_with-extras_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.4.json.bin => file_with-extras_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.4.xml.bin => file_with-extras_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.5.json.bin => file_with-extras_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-extras_1.5.xml.bin => file_with-extras_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.0.xml.bin => file_with-urls_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.1.xml.bin => file_with-urls_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.2.json.bin => file_with-urls_1.2.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.2.xml.bin => file_with-urls_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.3.json.bin => file_with-urls_1.3.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.3.xml.bin => file_with-urls_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.4.json.bin => file_with-urls_1.4.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.4.xml.bin => file_with-urls_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.5.json.bin => file_with-urls_1.5.json.bin} (100%)
 rename tests/_data/snapshots/pipenv/{with-urls_1.5.xml.bin => file_with-urls_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.0.xml.bin => group-deps_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.1.xml.bin => group-deps_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.2.json.bin => group-deps_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.2.xml.bin => group-deps_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.3.json.bin => group-deps_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.3.xml.bin => group-deps_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.4.json.bin => group-deps_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.4.xml.bin => group-deps_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.5.json.bin => group-deps_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock11-1.5.xml.bin => group-deps_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.0.xml.bin => group-deps_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.1.xml.bin => group-deps_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.2.json.bin => group-deps_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.2.xml.bin => group-deps_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.3.json.bin => group-deps_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.3.xml.bin => group-deps_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.4.json.bin => group-deps_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.4.xml.bin => group-deps_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.5.json.bin => group-deps_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{group-deps-lock20-1.5.xml.bin => group-deps_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.0.xml.bin => local_lock10_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.1.xml.bin => local_lock10_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.2.json.bin => local_lock10_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.2.xml.bin => local_lock10_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.3.json.bin => local_lock10_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.3.xml.bin => local_lock10_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.4.json.bin => local_lock10_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.4.xml.bin => local_lock10_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.5.json.bin => local_lock10_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock10-1.5.xml.bin => local_lock10_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.0.xml.bin => local_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.1.xml.bin => local_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.2.json.bin => local_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.2.xml.bin => local_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.3.json.bin => local_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.3.xml.bin => local_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.4.json.bin => local_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.4.xml.bin => local_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.5.json.bin => local_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock11-1.5.xml.bin => local_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.0.xml.bin => local_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.1.xml.bin => local_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.2.json.bin => local_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.2.xml.bin => local_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.3.json.bin => local_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.3.xml.bin => local_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.4.json.bin => local_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.4.xml.bin => local_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.5.json.bin => local_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{local-lock20-1.5.xml.bin => local_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.0.xml.bin => main-and-dev_lock10_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.1.xml.bin => main-and-dev_lock10_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.2.json.bin => main-and-dev_lock10_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.2.xml.bin => main-and-dev_lock10_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.3.json.bin => main-and-dev_lock10_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.3.xml.bin => main-and-dev_lock10_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.4.json.bin => main-and-dev_lock10_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.4.xml.bin => main-and-dev_lock10_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.5.json.bin => main-and-dev_lock10_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock10-1.5.xml.bin => main-and-dev_lock10_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.0.xml.bin => main-and-dev_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.1.xml.bin => main-and-dev_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.2.json.bin => main-and-dev_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.2.xml.bin => main-and-dev_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.3.json.bin => main-and-dev_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.3.xml.bin => main-and-dev_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.4.json.bin => main-and-dev_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.4.xml.bin => main-and-dev_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.5.json.bin => main-and-dev_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock11-1.5.xml.bin => main-and-dev_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.0.xml.bin => main-and-dev_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.1.xml.bin => main-and-dev_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.2.json.bin => main-and-dev_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.2.xml.bin => main-and-dev_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.3.json.bin => main-and-dev_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.3.xml.bin => main-and-dev_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.4.json.bin => main-and-dev_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.4.xml.bin => main-and-dev_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.5.json.bin => main-and-dev_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{main-and-dev-lock20-1.5.xml.bin => main-and-dev_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.0.xml.bin => no-deps_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.1.xml.bin => no-deps_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.2.json.bin => no-deps_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.2.xml.bin => no-deps_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.3.json.bin => no-deps_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.3.xml.bin => no-deps_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.4.json.bin => no-deps_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.4.xml.bin => no-deps_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.5.json.bin => no-deps_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-deps-lock20-1.5.xml.bin => no-deps_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.0.xml.bin => no-dev_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.1.xml.bin => no-dev_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.2.json.bin => no-dev_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.2.xml.bin => no-dev_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.3.json.bin => no-dev_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.3.xml.bin => no-dev_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.4.json.bin => no-dev_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.4.xml.bin => no-dev_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.5.json.bin => no-dev_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock11-1.5.xml.bin => no-dev_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.0.xml.bin => no-dev_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.1.xml.bin => no-dev_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.2.json.bin => no-dev_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.2.xml.bin => no-dev_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.3.json.bin => no-dev_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.3.xml.bin => no-dev_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.4.json.bin => no-dev_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.4.xml.bin => no-dev_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.5.json.bin => no-dev_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{no-dev-lock20-1.5.xml.bin => no-dev_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.0.xml.bin => only-groups_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.1.xml.bin => only-groups_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.2.json.bin => only-groups_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.2.xml.bin => only-groups_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.3.json.bin => only-groups_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.3.xml.bin => only-groups_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.4.json.bin => only-groups_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.4.xml.bin => only-groups_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.5.json.bin => only-groups_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock11-1.5.xml.bin => only-groups_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.0.xml.bin => only-groups_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.1.xml.bin => only-groups_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.2.json.bin => only-groups_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.2.xml.bin => only-groups_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.3.json.bin => only-groups_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.3.xml.bin => only-groups_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.4.json.bin => only-groups_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.4.xml.bin => only-groups_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.5.json.bin => only-groups_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{only-groups-lock20-1.5.xml.bin => only-groups_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.0.xml.bin => private-packges_lock10_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.1.xml.bin => private-packges_lock10_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.2.json.bin => private-packges_lock10_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.2.xml.bin => private-packges_lock10_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.3.json.bin => private-packges_lock10_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.3.xml.bin => private-packges_lock10_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.4.json.bin => private-packges_lock10_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.4.xml.bin => private-packges_lock10_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.5.json.bin => private-packges_lock10_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock10-1.5.xml.bin => private-packges_lock10_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.0.xml.bin => private-packges_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.1.xml.bin => private-packges_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.2.json.bin => private-packges_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.2.xml.bin => private-packges_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.3.json.bin => private-packges_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.3.xml.bin => private-packges_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.4.json.bin => private-packges_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.4.xml.bin => private-packges_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.5.json.bin => private-packges_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock11-1.5.xml.bin => private-packges_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.0.xml.bin => private-packges_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.1.xml.bin => private-packges_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.2.json.bin => private-packges_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.2.xml.bin => private-packges_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.3.json.bin => private-packges_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.3.xml.bin => private-packges_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.4.json.bin => private-packges_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.4.xml.bin => private-packges_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.5.json.bin => private-packges_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{private-packges-lock20-1.5.xml.bin => private-packges_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.0.xml.bin => regression-issue611_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.1.xml.bin => regression-issue611_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.2.json.bin => regression-issue611_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.2.xml.bin => regression-issue611_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.3.json.bin => regression-issue611_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.3.xml.bin => regression-issue611_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.4.json.bin => regression-issue611_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.4.xml.bin => regression-issue611_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.5.json.bin => regression-issue611_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{regression-issue611-lock20-1.5.xml.bin => regression-issue611_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.0.xml.bin => some-extras_lock10_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.1.xml.bin => some-extras_lock10_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.2.json.bin => some-extras_lock10_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.2.xml.bin => some-extras_lock10_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.3.json.bin => some-extras_lock10_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.3.xml.bin => some-extras_lock10_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.4.json.bin => some-extras_lock10_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.4.xml.bin => some-extras_lock10_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.5.json.bin => some-extras_lock10_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock10-1.5.xml.bin => some-extras_lock10_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.0.xml.bin => some-extras_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.1.xml.bin => some-extras_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.2.json.bin => some-extras_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.2.xml.bin => some-extras_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.3.json.bin => some-extras_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.3.xml.bin => some-extras_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.4.json.bin => some-extras_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.4.xml.bin => some-extras_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.5.json.bin => some-extras_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock11-1.5.xml.bin => some-extras_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.0.xml.bin => some-extras_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.1.xml.bin => some-extras_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.2.json.bin => some-extras_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.2.xml.bin => some-extras_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.3.json.bin => some-extras_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.3.xml.bin => some-extras_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.4.json.bin => some-extras_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.4.xml.bin => some-extras_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.5.json.bin => some-extras_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-extras-lock20-1.5.xml.bin => some-extras_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.0.xml.bin => some-groups_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.1.xml.bin => some-groups_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.2.json.bin => some-groups_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.2.xml.bin => some-groups_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.3.json.bin => some-groups_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.3.xml.bin => some-groups_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.4.json.bin => some-groups_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.4.xml.bin => some-groups_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.5.json.bin => some-groups_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock11-1.5.xml.bin => some-groups_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.0.xml.bin => some-groups_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.1.xml.bin => some-groups_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.2.json.bin => some-groups_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.2.xml.bin => some-groups_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.3.json.bin => some-groups_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.3.xml.bin => some-groups_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.4.json.bin => some-groups_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.4.xml.bin => some-groups_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.5.json.bin => some-groups_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{some-groups-lock20-1.5.xml.bin => some-groups_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.0.xml.bin => with-extras_lock10_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.1.xml.bin => with-extras_lock10_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.2.json.bin => with-extras_lock10_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.2.xml.bin => with-extras_lock10_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.3.json.bin => with-extras_lock10_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.3.xml.bin => with-extras_lock10_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.4.json.bin => with-extras_lock10_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.4.xml.bin => with-extras_lock10_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.5.json.bin => with-extras_lock10_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock10-1.5.xml.bin => with-extras_lock10_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.0.xml.bin => with-extras_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.1.xml.bin => with-extras_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.2.json.bin => with-extras_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.2.xml.bin => with-extras_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.3.json.bin => with-extras_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.3.xml.bin => with-extras_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.4.json.bin => with-extras_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.4.xml.bin => with-extras_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.5.json.bin => with-extras_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock11-1.5.xml.bin => with-extras_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.0.xml.bin => with-extras_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.1.xml.bin => with-extras_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.2.json.bin => with-extras_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.2.xml.bin => with-extras_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.3.json.bin => with-extras_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.3.xml.bin => with-extras_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.4.json.bin => with-extras_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.4.xml.bin => with-extras_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.5.json.bin => with-extras_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-extras-lock20-1.5.xml.bin => with-extras_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.0.xml.bin => with-urls_lock10_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.1.xml.bin => with-urls_lock10_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.2.json.bin => with-urls_lock10_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.2.xml.bin => with-urls_lock10_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.3.json.bin => with-urls_lock10_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.3.xml.bin => with-urls_lock10_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.4.json.bin => with-urls_lock10_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.4.xml.bin => with-urls_lock10_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.5.json.bin => with-urls_lock10_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock10-1.5.xml.bin => with-urls_lock10_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.0.xml.bin => with-urls_lock11_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.1.xml.bin => with-urls_lock11_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.2.json.bin => with-urls_lock11_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.2.xml.bin => with-urls_lock11_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.3.json.bin => with-urls_lock11_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.3.xml.bin => with-urls_lock11_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.4.json.bin => with-urls_lock11_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.4.xml.bin => with-urls_lock11_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.5.json.bin => with-urls_lock11_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock11-1.5.xml.bin => with-urls_lock11_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.0.xml.bin => with-urls_lock20_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.1.xml.bin => with-urls_lock20_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.2.json.bin => with-urls_lock20_1.2.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.2.xml.bin => with-urls_lock20_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.3.json.bin => with-urls_lock20_1.3.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.3.xml.bin => with-urls_lock20_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.4.json.bin => with-urls_lock20_1.4.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.4.xml.bin => with-urls_lock20_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.5.json.bin => with-urls_lock20_1.5.json.bin} (100%)
 rename tests/_data/snapshots/poetry/{with-urls-lock20-1.5.xml.bin => with-urls_lock20_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.0.xml-file.bin => file_frozen_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.1.xml-file.bin => file_frozen_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.2.json-file.bin => file_frozen_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.2.xml-file.bin => file_frozen_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.3.json-file.bin => file_frozen_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.3.xml-file.bin => file_frozen_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.4.json-file.bin => file_frozen_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.4.xml-file.bin => file_frozen_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.5.json-file.bin => file_frozen_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.5.xml-file.bin => file_frozen_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.0.xml-file.bin => file_local_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.1.xml-file.bin => file_local_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.2.json-file.bin => file_local_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.2.xml-file.bin => file_local_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.3.json-file.bin => file_local_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.3.xml-file.bin => file_local_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.4.json-file.bin => file_local_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.4.xml-file.bin => file_local_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.5.json-file.bin => file_local_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.5.xml-file.bin => file_local_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.0.xml-stream.bin => file_nested_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.1.xml-stream.bin => file_nested_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.2.json-file.bin => file_nested_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.2.xml-file.bin => file_nested_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.3.json-file.bin => file_nested_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.3.xml-file.bin => file_nested_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.4.json-file.bin => file_nested_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.4.xml-file.bin => file_nested_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.5.json-file.bin => file_nested_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.5.xml-file.bin => file_nested_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.0.xml-file.bin => file_private-packages_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.1.xml-file.bin => file_private-packages_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.2.json-file.bin => file_private-packages_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.2.xml-file.bin => file_private-packages_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.3.json-file.bin => file_private-packages_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.3.xml-file.bin => file_private-packages_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.4.json-file.bin => file_private-packages_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.4.xml-file.bin => file_private-packages_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.5.json-file.bin => file_private-packages_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.5.xml-file.bin => file_private-packages_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.0.xml-file.bin => file_regression-issue448.cp1252.txt_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.1.xml-file.bin => file_regression-issue448.cp1252.txt_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.2.json-file.bin => file_regression-issue448.cp1252.txt_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.2.xml-file.bin => file_regression-issue448.cp1252.txt_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.3.json-file.bin => file_regression-issue448.cp1252.txt_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.3.xml-file.bin => file_regression-issue448.cp1252.txt_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.4.json-file.bin => file_regression-issue448.cp1252.txt_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.4.xml-file.bin => file_regression-issue448.cp1252.txt_1.4.xml.bin} (100%)
 create mode 100644 tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
 create mode 100644 tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.0.xml-file.bin => file_with-comments_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.1.xml-file.bin => file_with-comments_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.2.json-file.bin => file_with-comments_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.2.xml-file.bin => file_with-comments_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.3.json-file.bin => file_with-comments_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.3.xml-file.bin => file_with-comments_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.4.json-file.bin => file_with-comments_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.4.xml-file.bin => file_with-comments_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.5.json-file.bin => file_with-comments_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.5.xml-file.bin => file_with-comments_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.0.xml-file.bin => file_with-extras_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.1.xml-file.bin => file_with-extras_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.2.json-file.bin => file_with-extras_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.2.xml-file.bin => file_with-extras_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.3.json-file.bin => file_with-extras_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.3.xml-file.bin => file_with-extras_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.4.json-file.bin => file_with-extras_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.4.xml-file.bin => file_with-extras_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.5.json-file.bin => file_with-extras_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.5.xml-file.bin => file_with-extras_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.0.xml-file.bin => file_with-hashes_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.1.xml-file.bin => file_with-hashes_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.2.json-file.bin => file_with-hashes_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.2.xml-file.bin => file_with-hashes_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.3.json-file.bin => file_with-hashes_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.3.xml-file.bin => file_with-hashes_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.4.json-file.bin => file_with-hashes_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.4.xml-file.bin => file_with-hashes_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.5.json-file.bin => file_with-hashes_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.5.xml-file.bin => file_with-hashes_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.0.xml-file.bin => file_with-urls_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.1.xml-file.bin => file_with-urls_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.2.json-file.bin => file_with-urls_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.2.xml-file.bin => file_with-urls_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.3.json-file.bin => file_with-urls_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.3.xml-file.bin => file_with-urls_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.4.json-file.bin => file_with-urls_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.4.xml-file.bin => file_with-urls_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.5.json-file.bin => file_with-urls_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.5.xml-file.bin => file_with-urls_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.0.xml-file.bin => file_without-pinned-versions_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.1.xml-file.bin => file_without-pinned-versions_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.2.json-file.bin => file_without-pinned-versions_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.2.xml-file.bin => file_without-pinned-versions_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.3.json-file.bin => file_without-pinned-versions_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.3.xml-file.bin => file_without-pinned-versions_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.4.json-file.bin => file_without-pinned-versions_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.4.xml-file.bin => file_without-pinned-versions_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.5.json-file.bin => file_without-pinned-versions_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.5.xml-file.bin => file_without-pinned-versions_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.0.xml-file.bin => stream_frozen_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.1.xml-file.bin => stream_frozen_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.2.json-stream.bin => stream_frozen_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.2.xml-stream.bin => stream_frozen_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.3.json-stream.bin => stream_frozen_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.3.xml-stream.bin => stream_frozen_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.4.json-stream.bin => stream_frozen_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.4.xml-stream.bin => stream_frozen_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.5.json-stream.bin => stream_frozen_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{frozen.txt-1.5.xml-stream.bin => stream_frozen_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.0.xml-stream.bin => stream_local_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.1.xml-stream.bin => stream_local_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.2.json-stream.bin => stream_local_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.2.xml-stream.bin => stream_local_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.3.json-stream.bin => stream_local_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.3.xml-stream.bin => stream_local_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.4.json-stream.bin => stream_local_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.4.xml-stream.bin => stream_local_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.5.json-stream.bin => stream_local_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{local.txt-1.5.xml-stream.bin => stream_local_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.0.xml-stream.bin => stream_nested_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.1.xml-stream.bin => stream_nested_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.2.json-stream.bin => stream_nested_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.2.xml-stream.bin => stream_nested_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.3.json-stream.bin => stream_nested_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.3.xml-stream.bin => stream_nested_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.4.json-stream.bin => stream_nested_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.4.xml-stream.bin => stream_nested_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.5.json-stream.bin => stream_nested_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{nested.txt-1.5.xml-stream.bin => stream_nested_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.0.xml-stream.bin => stream_private-packages_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.1.xml-stream.bin => stream_private-packages_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.2.json-stream.bin => stream_private-packages_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.2.xml-stream.bin => stream_private-packages_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.3.json-stream.bin => stream_private-packages_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.3.xml-stream.bin => stream_private-packages_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.4.json-stream.bin => stream_private-packages_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.4.xml-stream.bin => stream_private-packages_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.5.json-stream.bin => stream_private-packages_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{private-packages.txt-1.5.xml-stream.bin => stream_private-packages_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.0.xml-stream.bin => stream_regression-issue448.cp1252.txt_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin => stream_regression-issue448.cp1252.txt_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.2.json-stream.bin => stream_regression-issue448.cp1252.txt_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin => stream_regression-issue448.cp1252.txt_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.3.json-stream.bin => stream_regression-issue448.cp1252.txt_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin => stream_regression-issue448.cp1252.txt_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.4.json-stream.bin => stream_regression-issue448.cp1252.txt_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin => stream_regression-issue448.cp1252.txt_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.5.json-stream.bin => stream_regression-issue448.cp1252.txt_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{regression-issue448.cp1252.txt.bin-1.5.xml-stream.bin => stream_regression-issue448.cp1252.txt_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.0.xml-stream.bin => stream_with-comments_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.1.xml-stream.bin => stream_with-comments_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.2.json-stream.bin => stream_with-comments_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.2.xml-stream.bin => stream_with-comments_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.3.json-stream.bin => stream_with-comments_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.3.xml-stream.bin => stream_with-comments_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.4.json-stream.bin => stream_with-comments_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.4.xml-stream.bin => stream_with-comments_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.5.json-stream.bin => stream_with-comments_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-comments.txt-1.5.xml-stream.bin => stream_with-comments_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.0.xml-stream.bin => stream_with-extras_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.1.xml-stream.bin => stream_with-extras_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.2.json-stream.bin => stream_with-extras_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.2.xml-stream.bin => stream_with-extras_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.3.json-stream.bin => stream_with-extras_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.3.xml-stream.bin => stream_with-extras_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.4.json-stream.bin => stream_with-extras_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.4.xml-stream.bin => stream_with-extras_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.5.json-stream.bin => stream_with-extras_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-extras.txt-1.5.xml-stream.bin => stream_with-extras_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.0.xml-stream.bin => stream_with-hashes_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.1.xml-stream.bin => stream_with-hashes_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.2.json-stream.bin => stream_with-hashes_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.2.xml-stream.bin => stream_with-hashes_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.3.json-stream.bin => stream_with-hashes_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.3.xml-stream.bin => stream_with-hashes_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.4.json-stream.bin => stream_with-hashes_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.4.xml-stream.bin => stream_with-hashes_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.5.json-stream.bin => stream_with-hashes_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-hashes.txt-1.5.xml-stream.bin => stream_with-hashes_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.0.xml-stream.bin => stream_with-urls_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.1.xml-stream.bin => stream_with-urls_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.2.json-stream.bin => stream_with-urls_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.2.xml-stream.bin => stream_with-urls_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.3.json-stream.bin => stream_with-urls_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.3.xml-stream.bin => stream_with-urls_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.4.json-stream.bin => stream_with-urls_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.4.xml-stream.bin => stream_with-urls_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.5.json-stream.bin => stream_with-urls_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{with-urls.txt-1.5.xml-stream.bin => stream_with-urls_1.5.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.0.xml-stream.bin => stream_without-pinned-versions_1.0.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.1.xml-stream.bin => stream_without-pinned-versions_1.1.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.2.json-stream.bin => stream_without-pinned-versions_1.2.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.2.xml-stream.bin => stream_without-pinned-versions_1.2.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.3.json-stream.bin => stream_without-pinned-versions_1.3.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.3.xml-stream.bin => stream_without-pinned-versions_1.3.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.4.json-stream.bin => stream_without-pinned-versions_1.4.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.4.xml-stream.bin => stream_without-pinned-versions_1.4.xml.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.5.json-stream.bin => stream_without-pinned-versions_1.5.json.bin} (100%)
 rename tests/_data/snapshots/requirements/{without-pinned-versions.txt-1.5.xml-stream.bin => stream_without-pinned-versions_1.5.xml.bin} (100%)

diff --git a/pyproject.toml b/pyproject.toml
index d7888e2a..1e94eec8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -72,8 +72,9 @@ bandit = "1.7.5"
 tox = "4.11.3"
 # `types-toml` need to stay in sync with version of `toml`
 types-toml = "^0.10.0"
-# `types-setuptools` need to stay in sync with version of `setuptools` - but 47 was not typed...
-types-setuptools = ">= 57.0.0"
+# min version required to be able to install some dependencies
+# see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
+setuptools = ">= 47.0.0"
 
 [tool.poetry.scripts]
 cyclonedx-py = 'cyclonedx_py._internal.cli:run'
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.2.json.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/category-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/category-deps_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_category-deps_1.5.xml.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.2.json.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.3.json.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.4.json.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.5.json.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/default-and-dev_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/default-and-dev_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_default-and-dev_1.5.xml.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.2.json.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.3.json.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.4.json.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.5.json.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/editable-self_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/editable-self_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_editable-self_1.5.xml.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_local_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_local_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.2.json.bin b/tests/_data/snapshots/pipenv/file_local_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_local_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_local_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.3.json.bin b/tests/_data/snapshots/pipenv/file_local_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_local_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_local_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.4.json.bin b/tests/_data/snapshots/pipenv/file_local_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_local_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_local_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.5.json.bin b/tests/_data/snapshots/pipenv/file_local_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_local_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/local_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/local_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_local_1.5.xml.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.2.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/no-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/no-deps_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.2.json.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.3.json.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.4.json.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.5.json.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/private-packages_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/private-packages_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_private-packages_1.5.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.2.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.3.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.4.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.5.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-extras_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-extras_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.0.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.0.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.0.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.1.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.1.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.1.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.2.json.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.2.json.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.2.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.2.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.2.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.3.json.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.3.json.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.3.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.3.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.3.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.4.json.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.4.json.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.4.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.4.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.4.xml.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.5.json.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.5.json.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.5.json.bin
diff --git a/tests/_data/snapshots/pipenv/with-urls_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/pipenv/with-urls_1.5.xml.bin
rename to tests/_data/snapshots/pipenv/file_with-urls_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/group-deps-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/group-deps-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.0.xml.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.1.xml.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.2.json.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.2.xml.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.3.json.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.3.xml.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.4.json.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.4.xml.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.5.json.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock10-1.5.xml.bin
rename to tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/local-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/local-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.0.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.1.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.2.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.3.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.4.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock10-1.5.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/main-and-dev-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/no-deps-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-deps-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/no-dev-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/no-dev-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/only-groups-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/only-groups-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.0.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.1.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.2.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.2.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.3.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.3.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.4.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.4.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.5.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock10-1.5.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/private-packges-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/private-packges-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/regression-issue611-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.0.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.1.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.2.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.2.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.3.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.3.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.4.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.4.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.5.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock10-1.5.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/some-extras-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-extras-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/some-groups-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/some-groups-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.0.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.1.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.2.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.2.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.3.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.3.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.4.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.4.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.5.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock10-1.5.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/with-extras-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-extras-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.0.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.1.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.2.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.2.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.3.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.3.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.4.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.4.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.5.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock10-1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock10-1.5.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.0.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.1.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.2.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.2.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.3.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.3.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.4.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.4.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.5.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock11-1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock11-1.5.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.0.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.0.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.1.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.1.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.2.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.2.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.3.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.3.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.4.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.4.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.5.json.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
diff --git a/tests/_data/snapshots/poetry/with-urls-lock20-1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/poetry/with-urls-lock20-1.5.xml.bin
rename to tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_local_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_local_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_local_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_local_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_local_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_local_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_local_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_local_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_local_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_local_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_local_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/file_nested_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/file_nested_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/file_nested_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/file_nested_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_nested_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_nested_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_nested_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_nested_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_nested_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
new file mode 100644
index 00000000..a642b533
--- /dev/null
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
@@ -0,0 +1,86 @@
+{
+  "components": [
+    {
+      "bom-ref": "requirements-L6",
+      "description": "requirements line 6: packageurl-python>=0.9.4",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/packageurl-python/"
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L7",
+      "description": "requirements line 7: requirements_parser>=0.2.0",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/requirements_parser/"
+        }
+      ],
+      "name": "requirements_parser",
+      "purl": "pkg:pypi/requirements-parser",
+      "type": "library"
+    },
+    {
+      "bom-ref": "requirements-L8",
+      "description": "requirements line 8: setuptools>=50.3.2",
+      "externalReferences": [
+        {
+          "comment": "implicit dist url",
+          "type": "distribution",
+          "url": "https://pypi.org/simple/setuptools/"
+        }
+      ],
+      "name": "setuptools",
+      "purl": "pkg:pypi/setuptools",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "requirements-L6"
+    },
+    {
+      "ref": "requirements-L7"
+    },
+    {
+      "ref": "requirements-L8"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "some `reuqirements.txt` a root-component with all metadata",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "testing-requirements-txt",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
new file mode 100644
index 00000000..9bf8476d
--- /dev/null
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
@@ -0,0 +1,93 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>testing-requirements-txt</name>
+      <version>0.1.0</version>
+      <description>some `reuqirements.txt` a root-component with all metadata</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="requirements-L6">
+      <name>packageurl-python</name>
+      <description>requirements line 6: packageurl-python&gt;=0.9.4</description>
+      <purl>pkg:pypi/packageurl-python</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/packageurl-python/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L7">
+      <name>requirements_parser</name>
+      <description>requirements line 7: requirements_parser&gt;=0.2.0</description>
+      <purl>pkg:pypi/requirements-parser</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/requirements_parser/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="requirements-L8">
+      <name>setuptools</name>
+      <description>requirements line 8: setuptools&gt;=50.3.2</description>
+      <purl>pkg:pypi/setuptools</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.org/simple/setuptools/</url>
+          <comment>implicit dist url</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="requirements-L6"/>
+    <dependency ref="requirements-L7"/>
+    <dependency ref="requirements-L8"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-file.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-file.bin
rename to tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin b/tests/_data/snapshots/requirements/stream_frozen_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.0.xml-file.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin b/tests/_data/snapshots/requirements/stream_frozen_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.1.xml-file.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/frozen.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_frozen_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/frozen.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_frozen_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/local.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_local_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/local.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_local_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/nested.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_nested_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/nested.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_nested_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/private-packages.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_private-packages_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/regression-issue448.cp1252.txt.bin-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-comments.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-comments_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-extras.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-hashes.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-hashes_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/with-urls.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_with-urls_1.5.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.0.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.0.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.0.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.1.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.1.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.1.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.2.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.2.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.2.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.2.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.2.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.3.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.4.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.xml.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.json.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.json-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.json.bin
diff --git a/tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-stream.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.xml.bin
similarity index 100%
rename from tests/_data/snapshots/requirements/without-pinned-versions.txt-1.5.xml-stream.bin
rename to tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.xml.bin
diff --git a/tests/integration/test_pipenv.py b/tests/integration/test_pipenv.py
index fa631f56..6eea8f14 100644
--- a/tests/integration/test_pipenv.py
+++ b/tests/integration/test_pipenv.py
@@ -34,7 +34,7 @@
 projectdirs = list(dirname(lockfile) for lockfile in lockfiles)
 
 test_data = tuple(
-    (f'{basename(dirname(projectdir))}-{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
+    (f'{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
     for projectdir in projectdirs
     for of, sv in SUPPORTED_OF_SV
 )
@@ -102,9 +102,7 @@ def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of:
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+        self.assertEqualSnapshot(out, 'file', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('category-deps'))
     def test_cli_with_categories_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -123,9 +121,7 @@ def test_cli_with_categories_as_expected(self, projectdir: str, sv: SchemaVersio
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'some-categories_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+        self.assertEqualSnapshot(out, 'some-categories', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('default-and-dev'))
     def test_cli_with_dev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -144,9 +140,7 @@ def test_cli_with_dev_as_expected(self, projectdir: str, sv: SchemaVersion, of:
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'with-dev_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+        self.assertEqualSnapshot(out, 'with-dev', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('private-packages'))
     def test_cli_with_pypi_mirror_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -165,9 +159,15 @@ def test_cli_with_pypi_mirror_as_expected(self, projectdir: str, sv: SchemaVersi
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'pypi-mirror_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
-
-    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa:N802
-        super().assertEqualSnapshot(actual, join('pipenv', snapshot_name))
+        self.assertEqualSnapshot(out, 'pypi-mirror', projectdir, sv, of)
+
+    def assertEqualSnapshot(self, actual: str,  # noqa:N802
+                            purpose: str,
+                            projectdir: str,
+                            sv: SchemaVersion,
+                            of: OutputFormat
+                            ) -> None:
+        super().assertEqualSnapshot(
+            make_comparable(actual, of),
+            join('pipenv', f'{purpose}_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+        )
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_poetry.py
index 23c5b507..cfe44b5c 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_poetry.py
@@ -132,9 +132,7 @@ def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of:
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'{basename(dirname(projectdir))}-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+        self.assertEqualSnapshot(out, basename(dirname(projectdir)), projectdir, sv, of)
 
     @named_data(*test_data_file_filter('group-deps'))
     def test_cli_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -154,9 +152,7 @@ def test_cli_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, o
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'some-groups-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+        self.assertEqualSnapshot(out, 'some-groups', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('group-deps'))
     def test_cli_only_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -175,9 +171,7 @@ def test_cli_only_groups_as_expected(self, projectdir: str, sv: SchemaVersion, o
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'only-groups-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+        self.assertEqualSnapshot(out, 'only-groups', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('group-deps'))
     def test_cli_nodev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -196,9 +190,7 @@ def test_cli_nodev_as_expected(self, projectdir: str, sv: SchemaVersion, of: Out
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'no-dev-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
+        self.assertEqualSnapshot(out, 'no-dev', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('with-extras'))
     def test_cli_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -217,9 +209,15 @@ def test_cli_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, o
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'some-extras-{basename(projectdir)}-{sv.to_version()}.{of.name.lower()}')
-
-    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa:N802
-        super().assertEqualSnapshot(actual, join('poetry', snapshot_name))
+        self.assertEqualSnapshot(out, 'some-extras', projectdir, sv, of)
+
+    def assertEqualSnapshot(self, actual: str,  # noqa:N802
+                            purpose: str,
+                            projectdir: str,
+                            sv: SchemaVersion,
+                            of: OutputFormat
+                            ) -> None:  # noqa:N802
+        super().assertEqualSnapshot(
+            make_comparable(actual, of),
+            join('poetry', f'{purpose}_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+        )
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_requirements.py
index 410824b6..d57f29f0 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_requirements.py
@@ -21,7 +21,7 @@
 from contextlib import redirect_stderr, redirect_stdout
 from glob import glob
 from io import StringIO, TextIOWrapper
-from os.path import basename, join
+from os.path import basename, join, splitext
 from typing import Any, Tuple
 from unittest import TestCase
 from unittest.mock import patch
@@ -38,7 +38,7 @@
 
 
 test_data = tuple(
-    (f'{basename(infile)}-{sv.name}-{of.name}', infile, sv, of)
+    (f'{splitext(basename(infile))[0]}-{sv.name}-{of.name}', infile, sv, of)
     for infile in infiles
     for of, sv in SUPPORTED_OF_SV
 )
@@ -110,9 +110,7 @@ def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: Out
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}-file')
+        self.assertEqualSnapshot(out, 'file', infile, sv, of)
 
     @named_data(*test_data)
     def test_cli_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
@@ -132,9 +130,15 @@ def test_cli_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: O
             err = err.getvalue()
             out = out.getvalue()
         self.assertEqual(0, res, err)
-        self.assertEqualSnapshot(
-            make_comparable(out, of),
-            f'{basename(infile)}-{sv.to_version()}.{of.name.lower()}-stream')
-
-    def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa:N802
-        super().assertEqualSnapshot(actual, join('requirements', snapshot_name))
+        self.assertEqualSnapshot(out, 'stream', infile, sv, of)
+
+    def assertEqualSnapshot(self, actual: str,  # noqa:N802
+                            purpose: str,
+                            reqfile: str,
+                            sv: SchemaVersion,
+                            of: OutputFormat
+                            ) -> None:
+        super().assertEqualSnapshot(
+            make_comparable(actual, of),
+            join('requirements', f'{purpose}_{splitext(basename(reqfile))[0]}_{sv.to_version()}.{of.name.lower()}')
+        )

From 47066eb357509d5f549137fb77809f419bcede52 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 22 Dec 2023 05:06:11 +0100
Subject: [PATCH 147/155] reimplement SBOM from environment (#627)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/docker.yml                  |   25 +-
 .github/workflows/python.yml                  |    1 +
 .github/workflows/release.yml                 |   12 +-
 Dockerfile                                    |   21 +-
 README.md                                     |   16 +-
 cyclonedx_py/__main__.py                      |    6 +-
 cyclonedx_py/_internal/cli.py                 |    4 +-
 cyclonedx_py/_internal/environment.py         |  206 +++-
 cyclonedx_py/_internal/pipenv.py              |    4 +-
 cyclonedx_py/_internal/poetry.py              |   31 +-
 cyclonedx_py/_internal/requirements.py        |    2 +-
 cyclonedx_py/_internal/utils/cdx.py           |   32 +-
 .../utils/license_trove_classifier.py         |    2 -
 cyclonedx_py/_internal/utils/packaging.py     |   81 ++
 cyclonedx_py/_internal/utils/pep610.py        |  137 +++
 cyclonedx_py/_internal/utils/pep621.py        |   30 +-
 cyclonedx_py/_internal/utils/pep631.py        |   29 +
 pyproject.toml                                |    7 +-
 tests/__init__.py                             |   15 +-
 .../infiles/environment/broken-env/README.md  |    2 +
 .../environment/broken-env/broken-json.py     |    8 +
 .../environment/broken-env/non-zero.py        |    8 +
 .../infiles/environment/editable-self/init.py |   41 +
 .../environment/editable-self/pyproject.toml  |    8 +
 tests/_data/infiles/environment/local/init.py |   47 +
 .../infiles/environment/local/pyproject.toml  |    5 +
 .../_data/infiles/environment/no-deps/init.py |   25 +
 .../environment/no-deps/pyproject.toml        |   41 +
 .../infiles/environment/with-extras/init.py   |   64 +
 .../environment/with-extras/pinning.txt       |   28 +
 .../environment/with-extras/pyproject.toml    |   41 +
 .../infiles/environment/with-urls/init.py     |   57 +
 .../environment/with-urls/pyproject.toml      |    9 +
 tests/_data/infiles/pipenv/.envrc             |    5 +
 tests/_data/infiles/poetry/.envrc             |    5 +
 .../venv_editable-self_1.0.xml.bin            |   12 +
 .../venv_editable-self_1.1.xml.bin            |   22 +
 .../venv_editable-self_1.2.json.bin           |   62 +
 .../venv_editable-self_1.2.xml.bin            |   47 +
 .../venv_editable-self_1.3.json.bin           |   62 +
 .../venv_editable-self_1.3.xml.bin            |   47 +
 .../venv_editable-self_1.4.json.bin           |   58 +
 .../venv_editable-self_1.4.xml.bin            |   74 ++
 .../venv_editable-self_1.5.json.bin           |   58 +
 .../venv_editable-self_1.5.xml.bin            |   74 ++
 .../environment/venv_local_1.0.xml.bin        |   23 +
 .../environment/venv_local_1.1.xml.bin        |   53 +
 .../environment/venv_local_1.2.json.bin       |  106 ++
 .../environment/venv_local_1.2.xml.bin        |   78 ++
 .../environment/venv_local_1.3.json.bin       |  118 ++
 .../environment/venv_local_1.3.xml.bin        |   84 ++
 .../environment/venv_local_1.4.json.bin       |  114 ++
 .../environment/venv_local_1.4.xml.bin        |  111 ++
 .../environment/venv_local_1.5.json.bin       |  114 ++
 .../environment/venv_local_1.5.xml.bin        |  111 ++
 .../environment/venv_no-deps_1.0.xml.bin      |    4 +
 .../environment/venv_no-deps_1.1.xml.bin      |    4 +
 .../environment/venv_no-deps_1.2.json.bin     |   37 +
 .../environment/venv_no-deps_1.2.xml.bin      |   28 +
 .../environment/venv_no-deps_1.3.json.bin     |   37 +
 .../environment/venv_no-deps_1.3.xml.bin      |   28 +
 .../environment/venv_no-deps_1.4.json.bin     |   33 +
 .../environment/venv_no-deps_1.4.xml.bin      |   55 +
 .../environment/venv_no-deps_1.5.json.bin     |   33 +
 .../environment/venv_no-deps_1.5.xml.bin      |   55 +
 .../environment/venv_with-extras_1.0.xml.bin  |  201 ++++
 .../environment/venv_with-extras_1.1.xml.bin  |  681 +++++++++++
 .../environment/venv_with-extras_1.2.json.bin | 1049 +++++++++++++++++
 .../environment/venv_with-extras_1.2.xml.bin  |  778 ++++++++++++
 .../environment/venv_with-extras_1.3.json.bin | 1049 +++++++++++++++++
 .../environment/venv_with-extras_1.3.xml.bin  |  778 ++++++++++++
 .../environment/venv_with-extras_1.4.json.bin | 1045 ++++++++++++++++
 .../environment/venv_with-extras_1.4.xml.bin  |  805 +++++++++++++
 .../environment/venv_with-extras_1.5.json.bin | 1045 ++++++++++++++++
 .../environment/venv_with-extras_1.5.xml.bin  |  805 +++++++++++++
 .../environment/venv_with-urls_1.0.xml.bin    |   26 +
 .../environment/venv_with-urls_1.1.xml.bin    |   79 ++
 .../environment/venv_with-urls_1.2.json.bin   |  140 +++
 .../environment/venv_with-urls_1.2.xml.bin    |  106 ++
 .../environment/venv_with-urls_1.3.json.bin   |  152 +++
 .../environment/venv_with-urls_1.3.xml.bin    |  112 ++
 .../environment/venv_with-urls_1.4.json.bin   |  148 +++
 .../environment/venv_with-urls_1.4.xml.bin    |  139 +++
 .../environment/venv_with-urls_1.5.json.bin   |  148 +++
 .../environment/venv_with-urls_1.5.xml.bin    |  139 +++
 .../poetry/no-deps_lock20_1.2.json.bin        |   10 +-
 .../poetry/no-deps_lock20_1.2.xml.bin         |   10 +-
 .../poetry/no-deps_lock20_1.3.json.bin        |   10 +-
 .../poetry/no-deps_lock20_1.3.xml.bin         |   10 +-
 .../poetry/no-deps_lock20_1.4.json.bin        |   12 +-
 .../poetry/no-deps_lock20_1.4.xml.bin         |   12 +-
 .../poetry/no-deps_lock20_1.5.json.bin        |   12 +-
 .../poetry/no-deps_lock20_1.5.xml.bin         |   12 +-
 tests/integration/test_cli_environment.py     |  194 +++
 .../{test_pipenv.py => test_cli_pipenv.py}    |   14 +-
 .../{test_poetry.py => test_cli_poetry.py}    |   18 +-
 ...quirements.py => test_cli_requirements.py} |   10 +-
 97 files changed, 12391 insertions(+), 155 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/packaging.py
 create mode 100644 cyclonedx_py/_internal/utils/pep610.py
 create mode 100644 cyclonedx_py/_internal/utils/pep631.py
 create mode 100644 tests/_data/infiles/environment/broken-env/README.md
 create mode 100755 tests/_data/infiles/environment/broken-env/broken-json.py
 create mode 100755 tests/_data/infiles/environment/broken-env/non-zero.py
 create mode 100755 tests/_data/infiles/environment/editable-self/init.py
 create mode 100644 tests/_data/infiles/environment/editable-self/pyproject.toml
 create mode 100755 tests/_data/infiles/environment/local/init.py
 create mode 100644 tests/_data/infiles/environment/local/pyproject.toml
 create mode 100755 tests/_data/infiles/environment/no-deps/init.py
 create mode 100644 tests/_data/infiles/environment/no-deps/pyproject.toml
 create mode 100755 tests/_data/infiles/environment/with-extras/init.py
 create mode 100644 tests/_data/infiles/environment/with-extras/pinning.txt
 create mode 100644 tests/_data/infiles/environment/with-extras/pyproject.toml
 create mode 100755 tests/_data/infiles/environment/with-urls/init.py
 create mode 100644 tests/_data/infiles/environment/with-urls/pyproject.toml
 create mode 100644 tests/_data/infiles/pipenv/.envrc
 create mode 100644 tests/_data/infiles/poetry/.envrc
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_local_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
 create mode 100644 tests/integration/test_cli_environment.py
 rename tests/integration/{test_pipenv.py => test_cli_pipenv.py} (91%)
 rename tests/integration/{test_poetry.py => test_cli_poetry.py} (92%)
 rename tests/integration/{test_requirements.py => test_cli_requirements.py} (93%)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 78b73ee6..45edf8df 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -32,33 +32,27 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
       - name: setup reports-dir
         run: mkdir "$REPORTS_DIR"
-
       - name: Setup python ${{ env.PYTHON_VERSION }}
         # see https://github.com/actions/setup-python
         uses: actions/setup-python@v5
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: 'x64'
-
       - name: Setup poetry ${{ env.POETRY_VERSION }}
         # see https://github.com/marketplace/actions/setup-poetry
         uses: Gr1N/setup-poetry@v8
         with:
           poetry-version: ${{ env.POETRY_VERSION }}
-
       - name: bump version
         id: bump-version
         run: |
           VERSION="${{ github.run_id }}.${{ github.run_number }}.${{ github.run_attempt }}+testing"
           poetry version "$VERSION"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
-
       - name: Poetry build
         run: poetry build
-
       - name: Artifact python dist
         if: |
           !failure() && !cancelled() &&
@@ -69,7 +63,6 @@ jobs:
           name: ${{ env.RUN_ARTIFACT_PYTHON_DIST }}
           path: ${{ env.DIST_SOURCE_DIR }}/
           if-no-files-found: warn
-
       - name: Build Docker image
         env:
           VERSION: ${{ steps.bump-version.outputs.version }}
@@ -78,25 +71,20 @@ jobs:
           --build-arg "VERSION=$VERSION"
           -t "$DOCKER_TAG"
           .
-
       - name: Build own SBoM (XML)
         run: >
           docker run --rm "$DOCKER_TAG"
-          -X
-          --environment
-          --format=xml
-          --output=-
+          environment
+          -vvv
+          --output-format XML
           > "$REPORTS_DIR/docker-image.bom.xml"
-
       - name: Build own SBoM (JSON)
         run: >
           docker run --rm "$DOCKER_TAG"
-          -X
-          --environment
-          --format=json
-          --output=-
+          environment
+          -vvv
+          --output-format JSON
           > "$REPORTS_DIR/docker-image.bom.json"
-
       - name: Artifact reports
         if: ${{ ! cancelled() }}
         # see https://github.com/actions/upload-artifact
@@ -105,7 +93,6 @@ jobs:
           name: ${{ env.REPORTS_ARTIFACT }}
           path: ${{ env.REPORTS_DIR }}
           if-no-files-found: error
-
       - name: Destroy Docker image
         # run regardless of outcome
         if: ${{ always() }}
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 95a4a46c..f3d97d70 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -36,6 +36,7 @@ env:
   POETRY_VERSION: "1.4.1"
   REPORTS_DIR: CI_reports
   TESTS_REPORTS_ARTIFACT: tests-reports
+  PIPENV_VENV_IN_PROJECT: 1
 
 jobs:
   coding-standards:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1022ae1b..01bab0c0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -150,16 +150,16 @@ jobs:
       - name: Build own SBoM (XML)
         run: >
           docker run --rm "$DOCKER_REPO:$VERSION"
-          --environment
-          --format=xml
-          --output=-
+          environment
+          -vvv
+          --output-format XML
           > "$REPORTS_DIR/$ARTIFACT_DOCKER_SBOM.bom.xml"
       - name: Build own SBoM (JSON)
         run: >
           docker run --rm "$DOCKER_REPO:$VERSION"
-          --environment
-          --format=json
-          --output=-
+          environment
+          -vvv
+          --output-format JSON
           > "$REPORTS_DIR/$ARTIFACT_DOCKER_SBOM.bom.json"
       - name: Artifact reports
         if: ${{ ! cancelled() }}
diff --git a/Dockerfile b/Dockerfile
index 0c19e940..7ce4d8f2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,22 @@
-FROM python:3.10-slim-buster
+FROM python:3.11-slim
 
 ARG VERSION
 
-COPY ./dist /tmp/dist
-RUN pip install cyclonedx-bom==${VERSION} --find-links file:///tmp/dist
+ARG CDX_PATH=/url/local/cyclonedx-py
+ARG CDX_VENV=${CDX_PATH}/venv
+
+RUN mkdir -p "${CDX_PATH}"
+RUN python -m venv --without-pip "${CDX_VENV}"
+ENV VIRTUAL_ENV=${CDX_VENV}
+ENV PATH=${VIRTUAL_ENV}/bin:${PATH}
+
+COPY ./dist ${CDX_PATH}/dist
+RUN pip --python "${CDX_VENV}" \
+   install --no-cache-dir --no-input --progress-bar=off \
+   --verbose --debug \
+   --prefix "${CDX_VENV}" --require-virtualenv \
+   --compile \
+   "cyclonedx-bom==${VERSION}" --find-links "file://${CDX_PATH}/dist"
+RUN rm -rf ${CDX_PATH}/dist
+
 ENTRYPOINT ["cyclonedx-py"]
diff --git a/README.md b/README.md
index 938a9baa..4982cd42 100644
--- a/README.md
+++ b/README.md
@@ -14,16 +14,20 @@
 ----
 
 This project provides a runnable Python-based application 
-for generating software bill-of-material (SBOM) documents in [CycloneDX](https://cyclonedx.org/) format
-from either:
+for generating Software Bill of material (BOM) documents in [CycloneDX](https://cyclonedx.org/) format
+from:
 
-* Your current Python Environment
-* Your project's manifest (e.g. `Pipfile.lock`, `poetry.lock` or `requirements.txt`)
-* Conda as a Package Manager is no longer supported since version 4. Try an older version: `pip install 'cyclonedx-bom<4'`
+* Python (virtual) environment
+* `Poetry`
+* `Pipenv`
+* `requirements`
+* `Conda` as a Package Manager is no longer supported since version 4.
+  Try an older version(`pip install 'cyclonedx-bom<4'`).  
+  However, `conda` Python environments are fully supported.
 
 The SBOM will contain an aggregate of all your current project's dependencies, or those defined by the manifest you supply.
 
-CycloneDX is a lightweight BOM specification that is easily created, human-readable, and simple to parse.
+CycloneDX is a full-stack BOM specification that is easily created, human-readable, and simple to parse.
 
 Read the full [documentation][link_rtfd] for more details.
 
diff --git a/cyclonedx_py/__main__.py b/cyclonedx_py/__main__.py
index f65725f1..6d2c51c4 100644
--- a/cyclonedx_py/__main__.py
+++ b/cyclonedx_py/__main__.py
@@ -13,8 +13,8 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
-import sys
+from sys import exit
 
-from ._internal.cli import run
+from ._internal.cli import run as _run
 
-sys.exit(run(prog=f'python3 -m {__package__}'))
+exit(_run(prog=f'python -m {__package__}' if __package__ else None))
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index b38a9f18..de448cda 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -236,7 +236,7 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
                         action='count',
                         default=0)
     arg_parser = Command.make_argument_parser(**kwargs, sco=arg_co)
-    del arg_co
+    del arg_co, kwargs
     args = vars(arg_parser.parse_args(argv))
     if args['command'] is None:
         # print the help page on error, instead of usage
@@ -263,4 +263,6 @@ def run(*, argv: Optional[List[str]] = None, **kwargs: Any) -> int:
     else:
         return 0
     finally:
+        # if called programmatically (in tests), the handlers would stack up,
+        # since the logger is registered globally static
         logger.removeHandler(lh)
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index fcae8367..86a7a2c5 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, BinaryIO
+from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional, Set, Tuple
 
 from . import BomBuilder
 
@@ -25,6 +25,7 @@
     from logging import Logger
 
     from cyclonedx.model.bom import Bom
+    from cyclonedx.model.component import Component, ComponentType
 
 
 # !!! be as lazy loading as possible, as greedy as needed
@@ -35,11 +36,79 @@ class EnvironmentBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import ArgumentParser
+        from argparse import OPTIONAL, ArgumentParser
+        from os import name as os_name
+        from textwrap import dedent
+
+        from cyclonedx.model.component import ComponentType
+
+        from .utils.args import argparse_type4enum
 
         p = ArgumentParser(description='Build an SBOM from Python (virtual) environment',
                            **kwargs)
-        # TODO
+        if os_name == 'nt':
+            p.epilog = dedent("""\
+               Example Usage:
+                 • Build an SBOM from current python environment:
+                       > %(prog)s
+                 • Build an SBOM from a Python (virtual) environment:
+                       > %(prog)s "...some\\path\\bin\\python.exe"
+                 • Build an SBOM from specific Python environment:
+                       > where.exe python3.9.exe
+                       > %(prog)s "%%path to specific python%%"
+                 • Build an SBOM from conda Python environment:
+                       > conda run where python
+                       > %(prog)s "%%path to conda python%%"
+                 • Build an SBOM from Pipenv environment:
+                       > pipenv.exe --py
+                       > %(prog)s "%%path to pipenv python%%"
+                 • Build an SBOM from Poetry environment:
+                       > poetry.exe env info  --executable
+                       > %(prog)s "%%path to poetry python%%"
+               """)
+        else:  # if os_name == 'posix':
+            p.epilog = dedent("""\
+               Example Usage:
+                 • Build an SBOM from current python environment:
+                       $ %(prog)s
+                 • Build an SBOM from a Python (virtual) environment:
+                       $ %(prog)s '...some/path/bin/python'
+                 • Build an SBOM from specific Python environment:
+                       $ %(prog)s "$(which python3.9)"
+                 • Build an SBOM from conda Python environment:
+                       $ %(prog)s "$(conda run which python)"
+                 • Build an SBOM from Pipenv environment:
+                       $ %(prog)s "$(pipenv --py)"
+                 • Build an SBOM from Poetry environment:
+                       $ %(prog)s "$(poetry env info --executable)"
+               """)
+        p.add_argument('--pyproject',
+                       metavar='pyproject.toml',
+                       help="Path to the root component's `pyproject.toml` according to PEP621",
+                       dest='pyproject_file',
+                       default=None)
+        _mc_types = [ComponentType.APPLICATION,
+                     ComponentType.FIRMWARE,
+                     ComponentType.LIBRARY]
+        p.add_argument('--mc-type',
+                       metavar='TYPE',
+                       help='Type of the main component'
+                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
+                            ' (default: %(default)s)',
+                       dest='mc_type',
+                       choices=_mc_types,
+                       type=argparse_type4enum(ComponentType),
+                       default=ComponentType.APPLICATION)
+        # TODO possible additional switch:
+        #  `--exclude <package>` Exclude specified package from the output
+        #  `--local`        If in a virtualenv that has global access, do not list globally-installed packages.
+        #  `--user`         Only output packages installed in user-site.
+        #  `--path <path>`  Restrict to the specified installation path for listing packages
+        p.add_argument('python',
+                       metavar='python',
+                       help='Python interpreter',
+                       nargs=OPTIONAL,
+                       default=None)
         return p
 
     def __init__(self, *,
@@ -48,13 +117,136 @@ def __init__(self, *,
         self._logger = logger
 
     def __call__(self, *,  # type:ignore[override]
-                 lock: BinaryIO,
+                 python: Optional[str],
+                 pyproject_file: Optional[str],
+                 mc_type: 'ComponentType',
                  **__: Any) -> 'Bom':
+        from os import getcwd
+
         from .utils.cdx import make_bom
 
+        if pyproject_file is None:
+            rc = None
+        else:
+            from .utils.pep621 import pyproject2component, pyproject_dependencies, pyproject_load
+            from .utils.pep631 import requirement2package_name
+            pyproject = pyproject_load(pyproject_file)
+            root_c = pyproject2component(pyproject, type=mc_type)
+            root_c.bom_ref.value = 'root-component'
+            root_d = set(filter(None, map(requirement2package_name, pyproject_dependencies(pyproject))))
+            rc = (root_c, root_d)
+
+        path: List[str]
+        if python:
+            path = self.__path4python(python)
+        else:
+            from sys import path as sys_path
+            path = sys_path.copy()
+        if path[0] in ('', getcwd()):
+            path.pop(0)
+
         bom = make_bom()
+        self.__add_components(bom, rc, path=path)
+        return bom
 
-        # TODO
-        # maybe utilize https://github.com/tox-dev/pipdeptree ?
+    def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]],
+                         **kwargs: Any) -> None:
+        from importlib.metadata import distributions
+
+        from cyclonedx.model.component import Component, ComponentType
+        from packageurl import PackageURL
+
+        from .utils.cdx import licenses_fixup
+        from .utils.packaging import metadata2extrefs, metadata2licenses
+        from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref, packagesource4dist
+        from .utils.pep631 import requirement2package_name
+
+        all_components: Dict[str, Tuple['Component', Set[str]]] = {}
+        self._logger.debug('distribution context args: %r', kwargs)
+        self._logger.info('discovering distributions...')
+        for dist in distributions(**kwargs):
+            dist_meta = dist.metadata  # see https://packaging.python.org/en/latest/specifications/core-metadata/
+            dist_name = dist_meta['Name']
+            dist_version = dist_meta['Version']
+            component = Component(
+                type=ComponentType.LIBRARY,
+                bom_ref=f'{dist_name}=={dist_version}',
+                name=dist_name,
+                version=dist_version,
+                description=dist_meta['Summary'] if 'Summary' in dist_meta else None,
+                licenses=licenses_fixup(metadata2licenses(dist_meta)),
+                external_references=metadata2extrefs(dist_meta),
+                # path of dist-package on disc? naaa... a package may have multiple files/folders on disc
+            )
+            packagesource = packagesource4dist(dist)
+            purl_qs = {}
+            if packagesource is not None:
+                if isinstance(packagesource, PackageSourceVcs):
+                    purl_qs['vcs_url'] = f'{packagesource.vcs}+{packagesource.url}@{packagesource.commit_id}'
+                elif isinstance(packagesource, PackageSourceArchive):
+                    if '://files.pythonhosted.org/' not in packagesource.url:
+                        # skip PURL bloat, do not add implicit information
+                        purl_qs['download_url'] = packagesource.url
+                packagesource_extref = packagesource2extref(packagesource)
+                if packagesource_extref is not None:
+                    component.external_references.add(packagesource_extref)
+                del packagesource_extref
+            if packagesource is None or not packagesource.url.startswith('file://'):
+                # no purl for locals and unpublished packages
+                component.purl = PackageURL('pypi', name=dist_name, version=dist_version, qualifiers=purl_qs)
+            del dist_meta, dist_name, dist_version, packagesource, purl_qs
+
+            all_components[component.name.lower()] = (
+                component,
+                set(filter(None, map(requirement2package_name, dist.requires or ())))
+            )
+            self._logger.info('add component for package %r', component.name)
+            self._logger.debug('add component: %r', component)
+            bom.components.add(component)
+
+        if rc is not None:
+            root_c = rc[0]
+            root_c_lcname = root_c.name.lower()
+            root_c_existed = all_components.get(root_c_lcname)
+            if root_c_existed is not None:
+                bom.components.remove(root_c_existed[0])
+                del root_c_existed
+            all_components[root_c_lcname] = rc
+            bom.metadata.component = root_c
+
+        for component, requires in all_components.values():
+            # we know a lot of dependencies, but here we are only interested in those that are actually installed/found
+            requires_d: Iterable[Component] = filter(None,
+                                                     map(lambda r: all_components.get(r, (None,))[0],
+                                                         requires))
+            bom.register_dependency(component, requires_d)
 
-        return bom
+    @staticmethod
+    def __py_interpreter(value: str) -> str:
+        from os.path import exists, isdir, join
+        if not exists(value):
+            raise ValueError(f'No such file or directory: {value}')
+        if isdir(value):
+            for venv_loc in (
+                ('bin', 'python'),  # unix
+                ('Scripts', 'python.exe'),  # win
+            ):
+                maybe = join(value, *venv_loc)
+                if exists(maybe):
+                    return maybe
+            raise ValueError(f'Failed to find python in directory: {value}')
+        return value
+
+    def __path4python(self, python: str) -> List[str]:
+        from json import loads
+        from subprocess import run  # nosec
+        cmd = self.__py_interpreter(python), '-c', 'import json,sys;json.dump(sys.path,sys.stdout)'
+        self._logger.debug('fetch `path` from python interpreter cmd: %r', cmd)
+        res = run(cmd, capture_output=True, encoding='utf8', shell=False)  # nosec
+        if res.returncode != 0:
+            raise RuntimeError('Fail fetching `path` from Python interpreter.\n'
+                               f'returncode: {res.returncode}\n'
+                               f'stdout: {res.stdout}\n'
+                               f'stderr: {res.stderr}\n')
+        self._logger.debug('got `path` from Python interpreter: %r', res.stdout)
+        return loads(res.stdout)  # type:ignore[no-any-return]
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 31a38250..d9642d12 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -65,7 +65,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        help='both develop and default packages [env var: PIPENV_DEV]',
                        action='store_true',
                        dest='dev',
-                       default=getenv('PIPENV_DEV', '').lower() in ('1', 'true', 'yes'))
+                       default=getenv('PIPENV_DEV', '').lower() in ('1', 'true', 'yes', 'on'))
         p.add_argument('--pypi-mirror',
                        metavar='URL',
                        help='Specify a PyPI mirror [env var: PIPENV_PYPI_MIRROR]',
@@ -87,7 +87,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        dest='mc_type',
                        choices=_mc_types,
                        type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION.value)
+                       default=ComponentType.APPLICATION)
         p.add_argument('project_directory',
                        metavar='project-directory',
                        help='The project directory for Pipenv (default: current working directory)\n'
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index ef4550e9..c3a25268 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,7 +16,6 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-import re
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, Optional, Set, Tuple
 
@@ -128,7 +127,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        dest='mc_type',
                        choices=_mc_types,
                        type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION.value)
+                       default=ComponentType.APPLICATION)
         p.add_argument('project_directory',
                        metavar='project-directory',
                        help='The project directory for Poetry (default: current working directory)',
@@ -366,6 +365,8 @@ def __extrefs4poetryproj(self, po_cfg: 'NameDict') -> Generator['ExternalReferen
         from cyclonedx.exception.model import InvalidUriException
         from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
 
+        from .utils.cdx import url_label_to_ert
+
         for ers, ert in [
             # see https://python-poetry.org/docs/pyproject/
             ('homepage', ExternalReferenceType.WEBSITE),
@@ -379,30 +380,12 @@ def __extrefs4poetryproj(self, po_cfg: 'NameDict') -> Generator['ExternalReferen
                     url=XsUri(str(po_cfg[ers])))
             except (KeyError, InvalidUriException):  # pragma: nocover
                 pass
-        known_ulr_names = {
-            # see https://peps.python.org/pep-0345/#project-url-multiple-use
-            # see https://github.com/pypi/warehouse/issues/5947#issuecomment-699660629
-            'bugtracker': ExternalReferenceType.ISSUE_TRACKER,
-            'issuetracker': ExternalReferenceType.ISSUE_TRACKER,
-            'issues': ExternalReferenceType.ISSUE_TRACKER,
-            'tracker': ExternalReferenceType.ISSUE_TRACKER,
-            'homepage': ExternalReferenceType.WEBSITE,
-            'download': ExternalReferenceType.DISTRIBUTION,
-            'documentation': ExternalReferenceType.DOCUMENTATION,
-            'docs': ExternalReferenceType.DOCUMENTATION,
-            # 'changelog': ExternalReferenceType.RELEASE_NOTES, # not available in all versions of CycloneDX
-            'changes': ExternalReferenceType.RELEASE_NOTES,
-            'repository': ExternalReferenceType.VCS,
-            'github': ExternalReferenceType.VCS,
-            'chat': ExternalReferenceType.CHAT,
-        }
-        re_nochar = re.compile('[^a-z]')
-        for un, ul in po_cfg.get('urls', {}).items():
+        for ul, ut in po_cfg.get('urls', {}).items():
             try:
                 yield ExternalReference(
-                    comment=f'package urls: {un}',
-                    type=known_ulr_names.get(re_nochar.sub('', str(un).lower()), ExternalReferenceType.OTHER),
-                    url=XsUri(str(ul)))
+                    comment=f'package url: {ul}',
+                    type=url_label_to_ert(ul),
+                    url=XsUri(str(ut)))
             except InvalidUriException:  # pragma: nocover
                 pass
 
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 62a1f059..5d0dcacd 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -99,7 +99,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        dest='mc_type',
                        choices=_mc_types,
                        type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION.value)
+                       default=ComponentType.APPLICATION)
         p.add_argument('requirements_file',
                        metavar='requirements-file',
                        help='I HELP TODO (default: %(default)r in current working directory)',
diff --git a/cyclonedx_py/_internal/utils/cdx.py b/cyclonedx_py/_internal/utils/cdx.py
index 0e2b4da9..35051b6a 100644
--- a/cyclonedx_py/_internal/utils/cdx.py
+++ b/cyclonedx_py/_internal/utils/cdx.py
@@ -20,7 +20,8 @@
 CycloneDX related helpers and utils.
 """
 
-from typing import Any, Iterable
+from re import compile as re_compile
+from typing import Any, Dict, Iterable
 
 from cyclonedx.model import ExternalReference, ExternalReferenceType, Tool, XsUri
 from cyclonedx.model.bom import Bom
@@ -78,3 +79,32 @@ def licenses_fixup(licenses: Iterable['License']) -> Iterable['License']:
         if isinstance(license, LicenseExpression):
             return (license,)
     return licenses
+
+
+__known_ulr_labels: Dict[str, ExternalReferenceType] = {
+    # see https://peps.python.org/pep-0345/#project-url-multiple-use
+    # see https://github.com/pypi/warehouse/issues/5947#issuecomment-699660629
+    'bugtracker': ExternalReferenceType.ISSUE_TRACKER,
+    'issuetracker': ExternalReferenceType.ISSUE_TRACKER,
+    'issues': ExternalReferenceType.ISSUE_TRACKER,
+    'bugreports': ExternalReferenceType.ISSUE_TRACKER,
+    'tracker': ExternalReferenceType.ISSUE_TRACKER,
+    'homepage': ExternalReferenceType.WEBSITE,
+    'download': ExternalReferenceType.DISTRIBUTION,
+    'documentation': ExternalReferenceType.DOCUMENTATION,
+    'docs': ExternalReferenceType.DOCUMENTATION,
+    'changelog': ExternalReferenceType.RELEASE_NOTES,
+    'changes': ExternalReferenceType.RELEASE_NOTES,
+    # 'source': ExternalReferenceType.SOURCE-DISTRIBUTION,
+    'repository': ExternalReferenceType.VCS,
+    'github': ExternalReferenceType.VCS,
+    'chat': ExternalReferenceType.CHAT,
+}
+
+__re_nochar = re_compile('[^a-z]')
+
+
+def url_label_to_ert(value: str) -> ExternalReferenceType:
+    return __known_ulr_labels.get(
+        __re_nochar.sub('', str(value).lower()),
+        ExternalReferenceType.OTHER)
diff --git a/cyclonedx_py/_internal/utils/license_trove_classifier.py b/cyclonedx_py/_internal/utils/license_trove_classifier.py
index 45581f8f..7df04230 100644
--- a/cyclonedx_py/_internal/utils/license_trove_classifier.py
+++ b/cyclonedx_py/_internal/utils/license_trove_classifier.py
@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 # This file is part of CycloneDX Python Lib
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/cyclonedx_py/_internal/utils/packaging.py b/cyclonedx_py/_internal/utils/packaging.py
new file mode 100644
index 00000000..075b6841
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/packaging.py
@@ -0,0 +1,81 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+from typing import TYPE_CHECKING, Generator, List
+
+from cyclonedx.model import ExternalReferenceType
+
+if TYPE_CHECKING:  # pragma: no cover
+    import sys
+
+    if sys.version_info >= (3, 10):
+        from importlib.metadata import PackageMetadata
+    else:
+        from email.message import Message as PackageMetadata
+
+    from cyclonedx.model import ExternalReference
+    from cyclonedx.model.license import License
+
+
+def metadata2licenses(metadata: 'PackageMetadata') -> Generator['License', None, None]:
+    from cyclonedx.factory.license import LicenseFactory
+
+    from .pep621 import classifiers2licenses
+    lfac = LicenseFactory()
+    if 'Classifier' in metadata:
+        # see https://packaging.python.org/en/latest/specifications/core-metadata/#classifier-multiple-use
+        classifiers: List[str] = metadata.get_all('Classifier')  # type:ignore[assignment]
+        yield from classifiers2licenses(classifiers, lfac)
+    if 'License' in metadata:
+        # see https://packaging.python.org/en/latest/specifications/core-metadata/#license
+        yield lfac.make_from_string(metadata['License'])
+
+
+def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReference', None, None]:
+    from cyclonedx.exception.model import InvalidUriException
+    from cyclonedx.model import ExternalReference, XsUri
+
+    from .cdx import url_label_to_ert
+
+    if 'Home-page' in metadata:
+        # see https://packaging.python.org/en/latest/specifications/core-metadata/#home-page
+        try:
+            yield ExternalReference(
+                type=ExternalReferenceType.WEBSITE,
+                url=XsUri(metadata['Home-page']),
+                comment='Home-page')
+        except InvalidUriException:
+            pass
+    if 'Download-URL' in metadata:
+        # see https://packaging.python.org/en/latest/specifications/core-metadata/#download-url
+        try:
+            yield ExternalReference(
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri(metadata['Download-URL']),
+                comment='Download-URL')
+        except InvalidUriException:
+            pass
+    for label_url in metadata.get_all('Project-URL', ()):
+        # see https://packaging.python.org/en/latest/specifications/core-metadata/#project-url-multiple-use
+        label, url = label_url.split(',', maxsplit=1)
+        try:
+            yield ExternalReference(
+                type=url_label_to_ert(label),
+                url=XsUri(url.strip()),
+                comment=f'Project-URL: {label}')
+        except InvalidUriException:
+            pass
diff --git a/cyclonedx_py/_internal/utils/pep610.py b/cyclonedx_py/_internal/utils/pep610.py
new file mode 100644
index 00000000..e01e06b4
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/pep610.py
@@ -0,0 +1,137 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+"""
+Functionality related to PEP 610.
+
+See https://packaging.python.org/en/latest/specifications/direct-url/
+See https://peps.python.org/pep-0610/
+"""
+
+from abc import ABC, abstractmethod
+from json import JSONDecodeError, loads as json_loads
+from typing import TYPE_CHECKING, Any, Dict, Optional
+
+if TYPE_CHECKING:
+    from importlib.metadata import Distribution
+
+    from cyclonedx.model import ExternalReference
+
+
+class PackageSource(ABC):
+    @abstractmethod
+    def __init__(self, url: str) -> None:
+        self.url = url
+
+
+class PackageSourceVcs(PackageSource):
+    # see https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#vcs-urls
+
+    def __init__(self, url: str,
+                 vcs: str, requested_revision: Optional[str], commit_id: str) -> None:
+        super().__init__(url)
+        self.vcs = vcs
+        self.requested_revision = requested_revision
+        self.commit_id = commit_id
+
+    @classmethod
+    def from_data(cls, url: str, data: Dict[str, Any]) -> 'PackageSourceVcs':
+        return cls(url, data['vcs'], data.get('requested_revision'), data['commit_id'])
+
+
+class PackageSourceArchive(PackageSource):
+    # see https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#archive-urls
+
+    def __init__(self, url: str,
+                 hashes: Optional[Dict[str, str]]) -> None:
+        super().__init__(url)
+        self.hashes = hashes or {}
+
+    @classmethod
+    def from_data(cls, url: str, data: Dict[str, Any]) -> 'PackageSourceArchive':
+        if 'hashes' in data:
+            hashes = data['hashes']
+        elif 'hash' in data:
+            hash_parts = str(data['hash']).split('=', maxsplit=1)
+            hashes = {hash_parts[0]: hash_parts[1]}
+        else:
+            hashes = None
+        return cls(url, hashes)
+
+
+class PackageSourceLocal(PackageSource):
+    # see https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#local-directories
+
+    def __init__(self, url: str,
+                 editable: bool) -> None:
+        super().__init__(url)
+        self.editable = editable
+
+    @classmethod
+    def from_data(cls, url: str, data: Dict[str, Any]) -> 'PackageSourceLocal':
+        return cls(url, data.get('editable', False))
+
+
+def packagesource4dist(dist: 'Distribution') -> Optional[PackageSource]:
+    raw = dist.read_text('direct_url.json')
+    if raw is None:
+        return raw
+    try:
+        data = json_loads(raw)
+    except JSONDecodeError:  # pragma: no cover
+        return None
+    url = data['url']
+    if url == '':
+        return None
+    if 'vcs_info' in data:
+        return PackageSourceVcs.from_data(url, data['vcs_info'])
+    if 'archive_info' in data:
+        return PackageSourceArchive.from_data(url, data['archive_info'])
+    if 'dir_info' in data:
+        return PackageSourceLocal.from_data(url, data['dir_info'])
+    return None
+
+
+def packagesource2extref(src: PackageSource) -> Optional['ExternalReference']:
+    from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+    from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+    try:
+        if isinstance(src, PackageSourceVcs):
+            return ExternalReference(
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri(f'{src.url}#{src.commit_id}'),
+                comment=f'PackageSource: VCS {src.vcs!r}')
+        if isinstance(src, PackageSourceArchive):
+            hashes = []
+            for hashlib_alg, content in src.hashes.items():
+                try:
+                    hashes.append(HashType.from_hashlib_alg(hashlib_alg, content))
+                except UnknownHashTypeException:
+                    pass
+            return ExternalReference(
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri(src.url), hashes=hashes,
+                comment='PackageSource: Archive')
+        if isinstance(src, PackageSourceLocal):
+            return ExternalReference(
+                type=ExternalReferenceType.DISTRIBUTION,
+                url=XsUri(src.url),
+                comment='PackageSource: Local')
+    except InvalidUriException:
+        pass
+    return None
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index 735f86c7..d7f3a008 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -17,13 +17,12 @@
 
 
 """
-Functionality related to PEP 621
+Functionality related to PEP 621.
 
-See https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+See https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
 See https://peps.python.org/pep-0621/
 """
 
-
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable
 
 if TYPE_CHECKING:
@@ -72,19 +71,30 @@ def pyproject2component(pyproject: Dict[str, Any], *,
         description=project.get('description', None),
         licenses=licenses_fixup(pyproject2licenses(project, LicenseFactory())),
         # TODO add more properties according to spec
+        # extRefs with .cdx.url_label_to_ert()
     )
 
 
-def pyproject_file2component(pyproject_file: str, *,
-                             type: 'ComponentType') -> 'Component':
+def pyproject_load(pyproject_file: str) -> Dict[str, Any]:
     from .toml import toml_loads
-
     try:
         pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
     except OSError as err:
         raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
     with pyproject_fh:
-        return pyproject2component(
-            toml_loads(pyproject_fh.read()),
-            type=type
-        )
+        return toml_loads(pyproject_fh.read())
+
+
+def pyproject_file2component(pyproject_file: str, *,
+                             type: 'ComponentType') -> 'Component':
+    return pyproject2component(
+        pyproject_load(pyproject_file),
+        type=type
+    )
+
+
+def pyproject_dependencies(pyproject: Dict[str, Any]) -> Generator[str, None, None]:
+    project = pyproject.get('project', {})
+    yield from project.get('dependencies', ())
+    for opts in project.get('optional-dependencies', {}).values():
+        yield from opts
diff --git a/cyclonedx_py/_internal/utils/pep631.py b/cyclonedx_py/_internal/utils/pep631.py
new file mode 100644
index 00000000..a1d36f64
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/pep631.py
@@ -0,0 +1,29 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
+from typing import Optional
+
+from packaging.requirements import Requirement
+
+
+def requirement2package_name(value: str) -> Optional[str]:
+    # see https://peps.python.org/pep-0631/#implementation
+    try:
+        return Requirement(value).name
+    except Exception:
+        return None
diff --git a/pyproject.toml b/pyproject.toml
index 1e94eec8..2971396f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,12 +3,9 @@ name = "cyclonedx-bom"
 version = "4.0.0-alpha.0"
 description = "CycloneDX Software Bill of Materials (SBOM) generation utility"
 authors = [
-  "Steven Springett <steve.springett@owasp.org>",
-  "Paul Horton <phorton@sonatype.com>",
   "Jan Kowalleck <jan.kowalleck@gmail.com>",
 ]
 maintainers = [
-  "Paul Horton <phorton@sonatype.com>",
   "Jan Kowalleck <jan.kowalleck@gmail.com>",
 ]
 license = "Apache-2.0"
@@ -48,7 +45,7 @@ classifiers = [
 [tool.poetry.dependencies]
 python = "^3.8"
 # ATTENTION: keep `deps.lowest.r` file in sync
-cyclonedx-python-lib = { version = "^6.0.0", extras = ['validation'] }
+cyclonedx-python-lib = { version = "^6.1.0", extras = ['validation'] }
 packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
 tomli = { version = "^2.0.1", python = "<3.11" }
@@ -75,6 +72,8 @@ types-toml = "^0.10.0"
 # min version required to be able to install some dependencies
 # see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
 setuptools = ">= 47.0.0"
+# `pip --python <...> install` needed fot setup/ini of test-beds
+pip = ">=22.3"
 
 [tool.poetry.scripts]
 cyclonedx-py = 'cyclonedx_py._internal.cli:run'
diff --git a/tests/__init__.py b/tests/__init__.py
index f8ba3923..fe0d816a 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -20,8 +20,10 @@
 from json import dumps as json_dumps
 from os import getenv
 from os.path import dirname, join
+from pathlib import Path
 from typing import Union
 from unittest import TestCase
+from xml.sax.saxutils import escape as xml_escape, quoteattr as xml_quoteattr  # nosec:B406
 
 from cyclonedx.schema import OutputFormat, SchemaVersion
 
@@ -31,13 +33,15 @@
 if RECREATE_SNAPSHOTS:
     print('!!! WILL RECREATE ALL SNAPSHOTS !!!')
 
+INIT_TESTBEDS = '1' != getenv('CDX_TEST_SKIP_INIT_TESTBEDS')
+if INIT_TESTBEDS:
+    print('!!! WILL INIT TESTBEDS !!!')
 
 _TESTDATA_DIRECTORY = join(dirname(__file__), '_data')
 
 INFILES_DIRECTORY = join(_TESTDATA_DIRECTORY, 'infiles')
 SNAPSHOTS_DIRECTORY = join(_TESTDATA_DIRECTORY, 'snapshots')
 
-
 UNSUPPORTED_OF_SV = (
     (OutputFormat.JSON, SchemaVersion.V1_1),
     (OutputFormat.JSON, SchemaVersion.V1_0),
@@ -82,7 +86,15 @@ def assertEqualSnapshot(self: Union[TestCase, 'SnapshotMixin'],  # noqa: N802
 
 # region reproducible test results
 
+_root_file_uri = Path(__file__).parent.parent.absolute().as_uri() + '/'
+_root_file_uri_xml = xml_escape(_root_file_uri)
+_root_file_uri_xml_attr = xml_quoteattr(_root_file_uri)[1:-1]
+_root_file_uri_json = json_dumps(_root_file_uri)[1:-1]
+
+
 def make_xml_comparable(bom: str) -> str:
+    bom = bom.replace(_root_file_uri_xml, 'file://.../')
+    bom = bom.replace(_root_file_uri_xml_attr, 'file://.../')
     bom = re.sub(' serialNumber=".+?"', '', bom)
     bom = re.sub(r'\s*<timestamp>.*?</timestamp>', '', bom)
     bom = bom.replace(  # replace metadata.tools.version
@@ -114,6 +126,7 @@ def make_xml_comparable(bom: str) -> str:
 
 
 def make_json_comparable(bom: str) -> str:
+    bom = bom.replace(_root_file_uri_json, 'file://.../')
     bom = re.sub(r'\s*"(?:timestamp|serialNumber)": ".+?",?', '', bom)
     bom = bom.replace(  # replace metadata.tools.version
         '        "name": "cyclonedx-bom",\n'
diff --git a/tests/_data/infiles/environment/broken-env/README.md b/tests/_data/infiles/environment/broken-env/README.md
new file mode 100644
index 00000000..fac9afdb
--- /dev/null
+++ b/tests/_data/infiles/environment/broken-env/README.md
@@ -0,0 +1,2 @@
+A dir that MUST NOT contain any (python (virtual) environment.
+This is used in integration tests.
diff --git a/tests/_data/infiles/environment/broken-env/broken-json.py b/tests/_data/infiles/environment/broken-env/broken-json.py
new file mode 100755
index 00000000..1798a188
--- /dev/null
+++ b/tests/_data/infiles/environment/broken-env/broken-json.py
@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+
+"""
+print broken JSON.
+"""
+
+print(r'{"some unfinished json')
+exit(0)
diff --git a/tests/_data/infiles/environment/broken-env/non-zero.py b/tests/_data/infiles/environment/broken-env/non-zero.py
new file mode 100755
index 00000000..3b9daeef
--- /dev/null
+++ b/tests/_data/infiles/environment/broken-env/non-zero.py
@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+
+"""
+exit non-zero.
+"""
+
+print(r'[]')
+exit(1337)
diff --git a/tests/_data/infiles/environment/editable-self/init.py b/tests/_data/infiles/environment/editable-self/init.py
new file mode 100755
index 00000000..5fe23576
--- /dev/null
+++ b/tests/_data/infiles/environment/editable-self/init.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+
+"""
+initialize this testbed.
+"""
+
+from os import name as os_name
+from os.path import dirname, join
+from subprocess import check_call  # nosec:B404
+from sys import executable
+from venv import EnvBuilder
+
+__all__ = ['main']
+
+env_dir = join(dirname(__file__), '.venv')
+
+
+def pip_install(*args: str) -> None:
+    # pip is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pip',
+        '--python', env_dir,
+        'install', '--require-virtualenv', '--no-input', '--progress-bar=off', '--no-color',
+        *args
+    )
+    print('+ ', *call)
+    check_call(call, shell=False)  # nosec:B603
+
+
+def main() -> None:
+    EnvBuilder(
+        system_site_packages=False,
+        symlinks=os_name != 'nt',
+        with_pip=False,
+    ).create(env_dir)
+
+    pip_install('-e', dirname(__file__))
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/editable-self/pyproject.toml b/tests/_data/infiles/environment/editable-self/pyproject.toml
new file mode 100644
index 00000000..42d786f0
--- /dev/null
+++ b/tests/_data/infiles/environment/editable-self/pyproject.toml
@@ -0,0 +1,8 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "editable-self"
+version = "0.1.0"
+description = "install the current project as an editable"
+dependencies = [
+  'six==1.16.0'
+]
diff --git a/tests/_data/infiles/environment/local/init.py b/tests/_data/infiles/environment/local/init.py
new file mode 100755
index 00000000..507d3995
--- /dev/null
+++ b/tests/_data/infiles/environment/local/init.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+
+"""
+initialize this testbed.
+"""
+
+from os import name as os_name
+from os.path import abspath, dirname, join
+from subprocess import check_call  # nosec:B404
+from sys import executable
+from venv import EnvBuilder
+
+__all__ = ['main']
+
+env_dir = join(dirname(__file__), '.venv')
+
+localpackages_dir = abspath(join(dirname(__file__), '..', '..', '_helpers', 'local_pckages'))
+
+
+def pip_install(*args: str) -> None:
+    # pip is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pip',
+        '--python', env_dir,
+        'install', '--require-virtualenv', '--no-input', '--progress-bar=off', '--no-color',
+        *args
+    )
+    print('+ ', *call)
+    check_call(call, shell=False)  # nosec:B603
+
+
+def main() -> None:
+    EnvBuilder(
+        system_site_packages=False,
+        symlinks=os_name != 'nt',
+        with_pip=False,
+    ).create(env_dir)
+
+    pip_install(
+        join(localpackages_dir, 'a', 'dist', 'package_a-23.42-py3-none-any.whl'),
+        join(localpackages_dir, 'b', 'dist', 'package-b-23.42.tar.gz'),
+        join(localpackages_dir, 'c'),
+    )
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/local/pyproject.toml b/tests/_data/infiles/environment/local/pyproject.toml
new file mode 100644
index 00000000..6291093d
--- /dev/null
+++ b/tests/_data/infiles/environment/local/pyproject.toml
@@ -0,0 +1,5 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "local"
+version = "0.1.0"
+description = "packages from local paths"
diff --git a/tests/_data/infiles/environment/no-deps/init.py b/tests/_data/infiles/environment/no-deps/init.py
new file mode 100755
index 00000000..1f18d264
--- /dev/null
+++ b/tests/_data/infiles/environment/no-deps/init.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+
+"""
+initialize this testbed.
+"""
+
+from os import name as os_name
+from os.path import dirname, join
+from venv import EnvBuilder
+
+__all__ = ['main']
+
+env_dir = join(dirname(__file__), '.venv')
+
+
+def main() -> None:
+    EnvBuilder(
+        system_site_packages=False,
+        symlinks=os_name != 'nt',
+        with_pip=False,
+    ).create(env_dir)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/no-deps/pyproject.toml b/tests/_data/infiles/environment/no-deps/pyproject.toml
new file mode 100644
index 00000000..501d43c7
--- /dev/null
+++ b/tests/_data/infiles/environment/no-deps/pyproject.toml
@@ -0,0 +1,41 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "no-deps"
+version = "0.1.0"
+description = "packages with all meta, but no deps"
+license = {text="Apache-2.0 OR MIT"}
+readme = "README.md"
+requires-python = ">=3.8"
+
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
+
+#  dynamic = [] # TODO
+
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+
+keywords = ["packaging", "pipenv", "test"]
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
+
+# dependencies = [] # TODO
+# optional-dependencies = [] # TODO
+
+# entry-point = {} # TODO
+
+# gui-scripts = {} # TODO
+# scripts = {} # TODO
+
diff --git a/tests/_data/infiles/environment/with-extras/init.py b/tests/_data/infiles/environment/with-extras/init.py
new file mode 100755
index 00000000..9f090d6a
--- /dev/null
+++ b/tests/_data/infiles/environment/with-extras/init.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+"""
+initialize this testbed.
+"""
+
+from os import name as os_name
+from os.path import dirname, join
+from subprocess import PIPE, CompletedProcess, run  # nosec:B404
+from sys import argv, executable
+from typing import Any
+from venv import EnvBuilder
+
+__all__ = ['main']
+
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
+constraint_file = join(this_dir, 'pinning.txt')
+
+
+def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
+    # pip is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pip',
+        '--python', env_dir,
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, **kwargs, shell=False)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def pip_install(*args: str) -> None:
+    pip_run(
+        'install', '--require-virtualenv', '--no-input', '--progress-bar=off', '--no-color',
+        '-c', constraint_file,  # needed for reproducibility
+        *args
+    )
+
+
+def main() -> None:
+    EnvBuilder(
+        system_site_packages=False,
+        symlinks=os_name != 'nt',
+        with_pip=False,
+    ).create(env_dir)
+
+    pip_install(
+        'cyclonedx-python-lib[xml-validation,json-validation]',
+        # additionals for reproducibility foo
+        'importlib-resources>=1.4.0',
+        'pkgutil-resolve-name>=1.3.10',
+        'zipp>=3.1.0',
+    )
+
+
+if __name__ == '__main__':
+    main()
+    if '--pin' in argv:
+        res = pip_run('freeze', '--all', '--local', stdout=PIPE)
+        with open(constraint_file, 'wb') as cf:
+            cf.write(res.stdout)
diff --git a/tests/_data/infiles/environment/with-extras/pinning.txt b/tests/_data/infiles/environment/with-extras/pinning.txt
new file mode 100644
index 00000000..ddddf3c3
--- /dev/null
+++ b/tests/_data/infiles/environment/with-extras/pinning.txt
@@ -0,0 +1,28 @@
+arrow==1.3.0
+attrs==23.1.0
+boolean.py==4.0
+cyclonedx-python-lib==6.0.0
+defusedxml==0.7.1
+fqdn==1.5.1
+idna==3.6
+importlib-resources==6.1.1
+isoduration==20.11.0
+jsonpointer==2.4
+jsonschema==4.20.0
+jsonschema-specifications==2023.11.2
+license-expression==30.2.0
+lxml==4.9.4
+packageurl-python==0.13.1
+pkgutil_resolve_name==1.3.10
+py-serializable==0.16.0
+python-dateutil==2.8.2
+referencing==0.32.0
+rfc3339-validator==0.1.4
+rfc3987==1.3.8
+rpds-py==0.15.2
+six==1.16.0
+sortedcontainers==2.4.0
+types-python-dateutil==2.8.19.14
+uri-template==1.3.0
+webcolors==1.13
+zipp==3.17.0
diff --git a/tests/_data/infiles/environment/with-extras/pyproject.toml b/tests/_data/infiles/environment/with-extras/pyproject.toml
new file mode 100644
index 00000000..501d43c7
--- /dev/null
+++ b/tests/_data/infiles/environment/with-extras/pyproject.toml
@@ -0,0 +1,41 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "no-deps"
+version = "0.1.0"
+description = "packages with all meta, but no deps"
+license = {text="Apache-2.0 OR MIT"}
+readme = "README.md"
+requires-python = ">=3.8"
+
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
+
+#  dynamic = [] # TODO
+
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+
+keywords = ["packaging", "pipenv", "test"]
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
+
+# dependencies = [] # TODO
+# optional-dependencies = [] # TODO
+
+# entry-point = {} # TODO
+
+# gui-scripts = {} # TODO
+# scripts = {} # TODO
+
diff --git a/tests/_data/infiles/environment/with-urls/init.py b/tests/_data/infiles/environment/with-urls/init.py
new file mode 100755
index 00000000..ae264e1d
--- /dev/null
+++ b/tests/_data/infiles/environment/with-urls/init.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+
+"""
+initialize this testbed.
+"""
+
+from os import name as os_name
+from os.path import dirname, join
+from subprocess import CompletedProcess, run  # nosec:B404
+from sys import executable
+from typing import Any
+from venv import EnvBuilder
+
+__all__ = ['main']
+
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
+
+
+def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
+    # pip is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pip',
+        '--python', env_dir,
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, **kwargs, shell=False)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def pip_install(*args: str) -> None:
+    pip_run(
+        'install', '--require-virtualenv', '--no-input', '--progress-bar=off', '--no-color',
+        *args
+    )
+
+
+def main() -> None:
+    EnvBuilder(
+        system_site_packages=False,
+        symlinks=os_name != 'nt',
+        with_pip=False,
+    ).create(env_dir)
+
+    pip_install(
+        'git+https://github.com/pypa/packaging.git@23.2',
+        'urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip',
+        'https://files.pythonhosted.org/packages/d9/5a/'
+        'e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl',
+    )
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/with-urls/pyproject.toml b/tests/_data/infiles/environment/with-urls/pyproject.toml
new file mode 100644
index 00000000..9ddbb291
--- /dev/null
+++ b/tests/_data/infiles/environment/with-urls/pyproject.toml
@@ -0,0 +1,9 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "with-urls"
+version = "0.1.0"
+description = "packages from direct urls"
+dependencies = [
+  'six',
+  'something-that-is-not-insgalled',
+]
diff --git a/tests/_data/infiles/pipenv/.envrc b/tests/_data/infiles/pipenv/.envrc
new file mode 100644
index 00000000..213e1725
--- /dev/null
+++ b/tests/_data/infiles/pipenv/.envrc
@@ -0,0 +1,5 @@
+# https://pipenv.pypa.io/en/latest/configuration.html
+export PIPENV_VENV_IN_PROJECT=1
+export PIPENV_SITE_PACKAGES=0
+export PIPENV_DEV=1
+export PIPENV_NO_INHERIT=1
diff --git a/tests/_data/infiles/poetry/.envrc b/tests/_data/infiles/poetry/.envrc
new file mode 100644
index 00000000..381b3157
--- /dev/null
+++ b/tests/_data/infiles/poetry/.envrc
@@ -0,0 +1,5 @@
+# https://python-poetry.org/docs/configuration/#using-environment-variables
+export POETRY_VIRTUALENVS_IN_PROJECT=1
+export POETRY_VIRTUALENVS_OPTIONS_NO_PIP=1
+export POETRY_VIRTUALENVS_OPTIONS_NO_SETUPTOOLS=1
+export POETRY_VIRTUALENVS_OPTIONS_SYSTEM_SITE_PACKAGES=0
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.0.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.0.xml.bin
new file mode 100644
index 00000000..f54d9d57
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin
new file mode 100644
index 00000000..401d6522
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin
@@ -0,0 +1,22 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin
new file mode 100644
index 00000000..92a0daea
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin
@@ -0,0 +1,62 @@
+{
+  "components": [
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin
new file mode 100644
index 00000000..805ee934
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
new file mode 100644
index 00000000..988e242d
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
@@ -0,0 +1,62 @@
+{
+  "components": [
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
new file mode 100644
index 00000000..de07fa59
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
@@ -0,0 +1,47 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
new file mode 100644
index 00000000..e2740f78
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
@@ -0,0 +1,58 @@
+{
+  "components": [
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
new file mode 100644
index 00000000..7f1c9caa
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
@@ -0,0 +1,74 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
new file mode 100644
index 00000000..3887a176
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
@@ -0,0 +1,58 @@
+{
+  "components": [
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "install the current project as an editable",
+      "name": "editable-self",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
new file mode 100644
index 00000000..016d2d59
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
@@ -0,0 +1,74 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>editable-self</name>
+      <version>0.1.0</version>
+      <description>install the current project as an editable</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_local_1.0.xml.bin b/tests/_data/snapshots/environment/venv_local_1.0.xml.bin
new file mode 100644
index 00000000..13deb487
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.0.xml.bin
@@ -0,0 +1,23 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_local_1.1.xml.bin b/tests/_data/snapshots/environment/venv_local_1.1.xml.bin
new file mode 100644
index 00000000..74e71ad1
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.1.xml.bin
@@ -0,0 +1,53 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="package-a==23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b==23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c==23.42">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/c</url>
+          <comment>PackageSource: Local</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_local_1.2.json.bin b/tests/_data/snapshots/environment/venv_local_1.2.json.bin
new file mode 100644
index 00000000..83c6d8b0
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.2.json.bin
@@ -0,0 +1,106 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a==23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b==23.42",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-c==23.42",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Local",
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/c"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": "23.42"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a==23.42"
+    },
+    {
+      "ref": "package-b==23.42"
+    },
+    {
+      "ref": "package-c==23.42"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_local_1.2.xml.bin b/tests/_data/snapshots/environment/venv_local_1.2.xml.bin
new file mode 100644
index 00000000..9bd185ef
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.2.xml.bin
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a==23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b==23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c==23.42">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/c</url>
+          <comment>PackageSource: Local</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a==23.42"/>
+    <dependency ref="package-b==23.42"/>
+    <dependency ref="package-c==23.42"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_local_1.3.json.bin b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
new file mode 100644
index 00000000..bf2d83c1
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
@@ -0,0 +1,118 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a==23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
+            }
+          ],
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b==23.42",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
+            }
+          ],
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-c==23.42",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Local",
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/c"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": "23.42"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a==23.42"
+    },
+    {
+      "ref": "package-b==23.42"
+    },
+    {
+      "ref": "package-c==23.42"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_local_1.3.xml.bin b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
new file mode 100644
index 00000000..b2491503
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
@@ -0,0 +1,84 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a==23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b==23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c==23.42">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/c</url>
+          <comment>PackageSource: Local</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a==23.42"/>
+    <dependency ref="package-b==23.42"/>
+    <dependency ref="package-c==23.42"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.json.bin b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
new file mode 100644
index 00000000..0f7ce3f8
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
@@ -0,0 +1,114 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a==23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
+            }
+          ],
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b==23.42",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
+            }
+          ],
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-c==23.42",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Local",
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/c"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": "23.42"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a==23.42"
+    },
+    {
+      "ref": "package-b==23.42"
+    },
+    {
+      "ref": "package-c==23.42"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.xml.bin b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
new file mode 100644
index 00000000..f63bcb52
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
@@ -0,0 +1,111 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a==23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b==23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c==23.42">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/c</url>
+          <comment>PackageSource: Local</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a==23.42"/>
+    <dependency ref="package-b==23.42"/>
+    <dependency ref="package-c==23.42"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.json.bin b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
new file mode 100644
index 00000000..9db516ef
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
@@ -0,0 +1,114 @@
+{
+  "components": [
+    {
+      "bom-ref": "package-a==23.42",
+      "description": "some package A",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86"
+            }
+          ],
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-a",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-b==23.42",
+      "description": "some package B",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40"
+            }
+          ],
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-b",
+      "type": "library",
+      "version": "23.42"
+    },
+    {
+      "bom-ref": "package-c==23.42",
+      "description": "some package C",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Local",
+          "type": "distribution",
+          "url": "file://.../tests/_data/infiles/_helpers/local_pckages/c"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "package-c",
+      "type": "library",
+      "version": "23.42"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "package-a==23.42"
+    },
+    {
+      "ref": "package-b==23.42"
+    },
+    {
+      "ref": "package-c==23.42"
+    },
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from local paths",
+      "name": "local",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.xml.bin b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
new file mode 100644
index 00000000..c98ce8fa
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
@@ -0,0 +1,111 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>local</name>
+      <version>0.1.0</version>
+      <description>packages from local paths</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="package-a==23.42">
+      <name>package-a</name>
+      <version>23.42</version>
+      <description>some package A</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/a/dist/package_a-23.42-py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">4f37ac4a44c1dcce7f3d6203d45e9d1945a28f69fbfb44f418c44ea73c77de86</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-b==23.42">
+      <name>package-b</name>
+      <version>23.42</version>
+      <description>some package B</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/b/dist/package-b-23.42.tar.gz</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">33d37cf528bc0b20ec8ffd9fa21170e7caadb1b9f15eb559d1937fa4c82d3d40</hash>
+          </hashes>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="package-c==23.42">
+      <name>package-c</name>
+      <version>23.42</version>
+      <description>some package C</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <externalReferences>
+        <reference type="distribution">
+          <url>file://.../tests/_data/infiles/_helpers/local_pckages/c</url>
+          <comment>PackageSource: Local</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="package-a==23.42"/>
+    <dependency ref="package-b==23.42"/>
+    <dependency ref="package-c==23.42"/>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.0.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.0.xml.bin
new file mode 100644
index 00000000..acb06612
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.0.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.1.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.1.xml.bin
new file mode 100644
index 00000000..640f73ff
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.1.xml.bin
@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components/>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin
new file mode 100644
index 00000000..b1e74fb9
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin
@@ -0,0 +1,37 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin
new file mode 100644
index 00000000..1aa0d581
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
new file mode 100644
index 00000000..0e68e583
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
@@ -0,0 +1,37 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
new file mode 100644
index 00000000..bb7c9d9f
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
@@ -0,0 +1,28 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
new file mode 100644
index 00000000..c08f4eca
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
new file mode 100644
index 00000000..a6ae68bb
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
@@ -0,0 +1,55 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
new file mode 100644
index 00000000..a25741c6
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
@@ -0,0 +1,33 @@
+{
+  "dependencies": [
+    {
+      "ref": "root-component"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
new file mode 100644
index 00000000..461db07e
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
@@ -0,0 +1,55 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <dependencies>
+    <dependency ref="root-component"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.0.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.0.xml.bin
new file mode 100644
index 00000000..efa7100a
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.0.xml.bin
@@ -0,0 +1,201 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>cyclonedx-python-lib</name>
+      <version>6.0.0</version>
+      <description>Python library for CycloneDX</description>
+      <purl>pkg:pypi/cyclonedx-python-lib@6.0.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>idna</name>
+      <version>3.6</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901) </description>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>lxml</name>
+      <version>4.9.4</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <purl>pkg:pypi/lxml@4.9.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>packageurl-python</name>
+      <version>0.13.1</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <purl>pkg:pypi/packageurl-python@0.13.1</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>pkgutil_resolve_name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>py-serializable</name>
+      <version>0.16.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <purl>pkg:pypi/py-serializable@0.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>referencing</name>
+      <version>0.32.0</version>
+      <description>JSON Referencing + Python</description>
+      <purl>pkg:pypi/referencing@0.32.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>rpds-py</name>
+      <version>0.15.2</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <purl>pkg:pypi/rpds-py@0.15.2</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin
new file mode 100644
index 00000000..df180f04
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin
@@ -0,0 +1,681 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://arrow.readthedocs.io</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/arrow-py/arrow/issues</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/arrow-py/arrow</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://www.attrs.org/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-attrs/attrs/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-attrs/attrs</url>
+          <comment>Project-URL: Source Code</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/hynek</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="other">
+          <url>https://www.attrs.org/en/stable/changelog.html</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/bastikr/boolean.py</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==6.0.0">
+      <name>cyclonedx-python-lib</name>
+      <version>6.0.0</version>
+      <description>Python library for CycloneDX</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/cyclonedx-python-lib@6.0.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <licenses>
+        <license>
+          <id>Python-2.0</id>
+        </license>
+        <license>
+          <name>PSFL</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.python.org/pypi/defusedxml</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/tiran/defusedxml</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <licenses>
+        <license>
+          <name>MPL 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/ypcrts/fqdn</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/kjd/idna/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources==6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://importlib-resources.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/importlib_resources</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <licenses>
+        <license>
+          <id>ISC</id>
+        </license>
+        <license>
+          <name>UNKNOWN</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/bolsote/isoduration/issues</url>
+          <comment>Project-URL: Bug Reports</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901) </description>
+      <licenses>
+        <license>
+          <name>Modified BSD License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/stefankoegl/python-json-pointer</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://python-jsonschema.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://jsonschema-specifications.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/nexB/license-expression</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.4">
+      <name>lxml</name>
+      <version>4.9.4</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/lxml@4.9.4</purl>
+      <externalReferences>
+        <reference type="other">
+          <url>https://github.com/lxml/lxml</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://lxml.de/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.13.1">
+      <name>packageurl-python</name>
+      <version>0.13.1</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/packageurl-python@0.13.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/package-url/packageurl-python</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil_resolve_name==1.3.10">
+      <name>pkgutil_resolve_name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/graingert/pkgutil-resolve-name</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.16.0">
+      <name>py-serializable</name>
+      <version>0.16.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/py-serializable@0.16.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/madpah/serializable/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <licenses>
+        <license>
+          <name>Dual License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://dateutil.readthedocs.io/en/stable/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing==0.32.0">
+      <name>referencing</name>
+      <version>0.32.0</version>
+      <description>JSON Referencing + Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/referencing@0.32.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://referencing.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/referencing/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/naimetti/rfc3339-validator</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <licenses>
+        <license>
+          <id>GPL-3.0-or-later</id>
+        </license>
+        <license>
+          <name>GNU GPLv3+</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/dgerber/rfc3987</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>http://pypi.python.org/pypi/rfc3987</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.15.2">
+      <name>rpds-py</name>
+      <version>0.15.2</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rpds-py@0.15.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://rpds.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/crate-py/rpds/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <licenses>
+        <license>
+          <name>Apache 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <licenses>
+        <license>
+          <name>Apache-2.0 license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="chat">
+          <url>https://gitter.im/python/typing</url>
+          <comment>Project-URL: Chat</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python/typeshed/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
+          <comment>Project-URL: Changes</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Project-URL: GitHub</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://gitlab.linss.com/open-source/python/uri-template</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://webcolors.readthedocs.io</url>
+          <comment>Project-URL: documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/ubernostrum/webcolors</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp==3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/jaraco/zipp</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
new file mode 100644
index 00000000..6deb0de9
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
@@ -0,0 +1,1049 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://arrow.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/arrow-py/arrow/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/arrow-py/arrow"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://www.attrs.org/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-attrs/attrs/issues"
+        },
+        {
+          "comment": "Project-URL: Source Code",
+          "type": "other",
+          "url": "https://github.com/python-attrs/attrs"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/hynek"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://www.attrs.org/en/stable/changelog.html"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bastikr/boolean.py"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-2-Clause"
+          }
+        }
+      ],
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==6.0.0",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://cyclonedx-python-library.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@6.0.0",
+      "type": "library",
+      "version": "6.0.0"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://pypi.python.org/pypi/defusedxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/tiran/defusedxml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Python-2.0"
+          }
+        },
+        {
+          "license": {
+            "name": "PSFL"
+          }
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/ypcrts/fqdn"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "MPL 2.0"
+          }
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/kjd/idna/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/kjd/idna"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "importlib-resources==6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://importlib-resources.readthedocs.io/"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/importlib_resources"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Reports",
+          "type": "issue-tracker",
+          "url": "https://github.com/bolsote/isoduration/issues"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/bolsote/isoduration"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bolsote/isoduration"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "ISC"
+          }
+        },
+        {
+          "license": {
+            "name": "UNKNOWN"
+          }
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901) ",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/stefankoegl/python-json-pointer"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Modified BSD License"
+          }
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://python-jsonschema.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://jsonschema-specifications.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/nexB/license-expression"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.4",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/lxml/lxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://lxml.de/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.4",
+      "type": "library",
+      "version": "4.9.4"
+    },
+    {
+      "bom-ref": "packageurl-python==0.13.1",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/package-url/packageurl-python"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.13.1",
+      "type": "library",
+      "version": "0.13.1"
+    },
+    {
+      "bom-ref": "pkgutil_resolve_name==1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/graingert/pkgutil-resolve-name"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "pkgutil_resolve_name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable==0.16.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/madpah/serializable/issues"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/madpah/serializable"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/madpah/serializable"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.16.0",
+      "type": "library",
+      "version": "0.16.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://dateutil.readthedocs.io/en/stable/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/dateutil/dateutil"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/dateutil/dateutil"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Dual License"
+          }
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.32.0",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://referencing.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/referencing/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/referencing"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/referencing"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.32.0",
+      "type": "library",
+      "version": "0.32.0"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/naimetti/rfc3339-validator"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT license"
+          }
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://github.com/dgerber/rfc3987"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://pypi.python.org/pypi/rfc3987"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-3.0-or-later"
+          }
+        },
+        {
+          "license": {
+            "name": "GNU GPLv3+"
+          }
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.15.2",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://rpds.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/crate-py/rpds/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/crate-py/rpds"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/crate-py/rpds"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.15.2",
+      "type": "library",
+      "version": "0.15.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://www.grantjenks.com/docs/sortedcontainers/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache 2.0"
+          }
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Chat",
+          "type": "chat",
+          "url": "https://gitter.im/python/typing"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python/typeshed/issues"
+        },
+        {
+          "comment": "Project-URL: Changes",
+          "type": "other",
+          "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
+        },
+        {
+          "comment": "Project-URL: GitHub",
+          "type": "vcs",
+          "url": "https://github.com/python/typeshed"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/typeshed"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache-2.0 license"
+          }
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://gitlab.linss.com/open-source/python/uri-template"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT License"
+          }
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: documentation",
+          "type": "documentation",
+          "url": "https://webcolors.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://github.com/ubernostrum/webcolors"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp==3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/jaraco/zipp"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil==2.8.2",
+        "types-python-dateutil==2.8.19.14"
+      ],
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0"
+      ],
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema==4.20.0",
+        "license-expression==30.2.0",
+        "lxml==4.9.4",
+        "packageurl-python==0.13.1",
+        "py-serializable==0.16.0",
+        "sortedcontainers==2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib==6.0.0"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "dependsOn": [
+        "zipp==3.17.0"
+      ],
+      "ref": "importlib-resources==6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow==1.3.0"
+      ],
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources==6.1.1",
+        "referencing==0.32.0"
+      ],
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "fqdn==1.5.1",
+        "idna==3.6",
+        "importlib-resources==6.1.1",
+        "isoduration==20.11.0",
+        "jsonpointer==2.4",
+        "jsonschema-specifications==2023.11.2",
+        "referencing==0.32.0",
+        "rfc3339-validator==0.1.4",
+        "rfc3987==1.3.8",
+        "rpds-py==0.15.2",
+        "uri-template==1.3.0",
+        "webcolors==1.13"
+      ],
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "dependsOn": [
+        "boolean.py==4.0"
+      ],
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.4"
+    },
+    {
+      "ref": "packageurl-python==0.13.1"
+    },
+    {
+      "ref": "pkgutil_resolve_name==1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml==0.7.1"
+      ],
+      "ref": "py-serializable==0.16.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "rpds-py==0.15.2"
+      ],
+      "ref": "referencing==0.32.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.15.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    },
+    {
+      "ref": "zipp==3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
new file mode 100644
index 00000000..ffb0794b
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
@@ -0,0 +1,778 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://arrow.readthedocs.io</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/arrow-py/arrow/issues</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/arrow-py/arrow</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://www.attrs.org/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-attrs/attrs/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-attrs/attrs</url>
+          <comment>Project-URL: Source Code</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/hynek</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="other">
+          <url>https://www.attrs.org/en/stable/changelog.html</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/bastikr/boolean.py</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==6.0.0">
+      <name>cyclonedx-python-lib</name>
+      <version>6.0.0</version>
+      <description>Python library for CycloneDX</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/cyclonedx-python-lib@6.0.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <licenses>
+        <license>
+          <id>Python-2.0</id>
+        </license>
+        <license>
+          <name>PSFL</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.python.org/pypi/defusedxml</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/tiran/defusedxml</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <licenses>
+        <license>
+          <name>MPL 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/ypcrts/fqdn</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/kjd/idna/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources==6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://importlib-resources.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/importlib_resources</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <licenses>
+        <license>
+          <id>ISC</id>
+        </license>
+        <license>
+          <name>UNKNOWN</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/bolsote/isoduration/issues</url>
+          <comment>Project-URL: Bug Reports</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901) </description>
+      <licenses>
+        <license>
+          <name>Modified BSD License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/stefankoegl/python-json-pointer</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://python-jsonschema.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://jsonschema-specifications.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/nexB/license-expression</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.4">
+      <name>lxml</name>
+      <version>4.9.4</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/lxml@4.9.4</purl>
+      <externalReferences>
+        <reference type="other">
+          <url>https://github.com/lxml/lxml</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://lxml.de/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.13.1">
+      <name>packageurl-python</name>
+      <version>0.13.1</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/packageurl-python@0.13.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/package-url/packageurl-python</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil_resolve_name==1.3.10">
+      <name>pkgutil_resolve_name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/graingert/pkgutil-resolve-name</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.16.0">
+      <name>py-serializable</name>
+      <version>0.16.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/py-serializable@0.16.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/madpah/serializable/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <licenses>
+        <license>
+          <name>Dual License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://dateutil.readthedocs.io/en/stable/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing==0.32.0">
+      <name>referencing</name>
+      <version>0.32.0</version>
+      <description>JSON Referencing + Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/referencing@0.32.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://referencing.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/referencing/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/naimetti/rfc3339-validator</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <licenses>
+        <license>
+          <id>GPL-3.0-or-later</id>
+        </license>
+        <license>
+          <name>GNU GPLv3+</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/dgerber/rfc3987</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>http://pypi.python.org/pypi/rfc3987</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.15.2">
+      <name>rpds-py</name>
+      <version>0.15.2</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rpds-py@0.15.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://rpds.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/crate-py/rpds/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <licenses>
+        <license>
+          <name>Apache 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <licenses>
+        <license>
+          <name>Apache-2.0 license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="chat">
+          <url>https://gitter.im/python/typing</url>
+          <comment>Project-URL: Chat</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python/typeshed/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
+          <comment>Project-URL: Changes</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Project-URL: GitHub</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://gitlab.linss.com/open-source/python/uri-template</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://webcolors.readthedocs.io</url>
+          <comment>Project-URL: documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/ubernostrum/webcolors</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp==3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/jaraco/zipp</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0">
+      <dependency ref="python-dateutil==2.8.2"/>
+      <dependency ref="types-python-dateutil==2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs==23.1.0">
+      <dependency ref="attrs==23.1.0"/>
+    </dependency>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==6.0.0">
+      <dependency ref="jsonschema==4.20.0"/>
+      <dependency ref="license-expression==30.2.0"/>
+      <dependency ref="lxml==4.9.4"/>
+      <dependency ref="packageurl-python==0.13.1"/>
+      <dependency ref="py-serializable==0.16.0"/>
+      <dependency ref="sortedcontainers==2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="importlib-resources==6.1.1">
+      <dependency ref="zipp==3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration==20.11.0">
+      <dependency ref="arrow==1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2">
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="referencing==0.32.0"/>
+    </dependency>
+    <dependency ref="jsonschema==4.20.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="fqdn==1.5.1"/>
+      <dependency ref="idna==3.6"/>
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="isoduration==20.11.0"/>
+      <dependency ref="jsonpointer==2.4"/>
+      <dependency ref="jsonschema-specifications==2023.11.2"/>
+      <dependency ref="referencing==0.32.0"/>
+      <dependency ref="rfc3339-validator==0.1.4"/>
+      <dependency ref="rfc3987==1.3.8"/>
+      <dependency ref="rpds-py==0.15.2"/>
+      <dependency ref="uri-template==1.3.0"/>
+      <dependency ref="webcolors==1.13"/>
+    </dependency>
+    <dependency ref="license-expression==30.2.0">
+      <dependency ref="boolean.py==4.0"/>
+    </dependency>
+    <dependency ref="lxml==4.9.4"/>
+    <dependency ref="packageurl-python==0.13.1"/>
+    <dependency ref="pkgutil_resolve_name==1.3.10"/>
+    <dependency ref="py-serializable==0.16.0">
+      <dependency ref="defusedxml==0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil==2.8.2">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="referencing==0.32.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="rpds-py==0.15.2"/>
+    </dependency>
+    <dependency ref="rfc3339-validator==0.1.4">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.15.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+    <dependency ref="zipp==3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
new file mode 100644
index 00000000..42bbd250
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
@@ -0,0 +1,1049 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://arrow.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/arrow-py/arrow/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/arrow-py/arrow"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://www.attrs.org/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-attrs/attrs/issues"
+        },
+        {
+          "comment": "Project-URL: Source Code",
+          "type": "other",
+          "url": "https://github.com/python-attrs/attrs"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/hynek"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://www.attrs.org/en/stable/changelog.html"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bastikr/boolean.py"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-2-Clause"
+          }
+        }
+      ],
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==6.0.0",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://cyclonedx-python-library.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@6.0.0",
+      "type": "library",
+      "version": "6.0.0"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://pypi.python.org/pypi/defusedxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/tiran/defusedxml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Python-2.0"
+          }
+        },
+        {
+          "license": {
+            "name": "PSFL"
+          }
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/ypcrts/fqdn"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "MPL 2.0"
+          }
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/kjd/idna/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/kjd/idna"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "importlib-resources==6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://importlib-resources.readthedocs.io/"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/importlib_resources"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Reports",
+          "type": "issue-tracker",
+          "url": "https://github.com/bolsote/isoduration/issues"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/bolsote/isoduration"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bolsote/isoduration"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "ISC"
+          }
+        },
+        {
+          "license": {
+            "name": "UNKNOWN"
+          }
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901) ",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/stefankoegl/python-json-pointer"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Modified BSD License"
+          }
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://python-jsonschema.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://jsonschema-specifications.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/nexB/license-expression"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.4",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/lxml/lxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://lxml.de/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.4",
+      "type": "library",
+      "version": "4.9.4"
+    },
+    {
+      "bom-ref": "packageurl-python==0.13.1",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/package-url/packageurl-python"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.13.1",
+      "type": "library",
+      "version": "0.13.1"
+    },
+    {
+      "bom-ref": "pkgutil_resolve_name==1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/graingert/pkgutil-resolve-name"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "pkgutil_resolve_name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable==0.16.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/madpah/serializable/issues"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/madpah/serializable"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/madpah/serializable"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.16.0",
+      "type": "library",
+      "version": "0.16.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://dateutil.readthedocs.io/en/stable/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/dateutil/dateutil"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/dateutil/dateutil"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Dual License"
+          }
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.32.0",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://referencing.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/referencing/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/referencing"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/referencing"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.32.0",
+      "type": "library",
+      "version": "0.32.0"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/naimetti/rfc3339-validator"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT license"
+          }
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://github.com/dgerber/rfc3987"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://pypi.python.org/pypi/rfc3987"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-3.0-or-later"
+          }
+        },
+        {
+          "license": {
+            "name": "GNU GPLv3+"
+          }
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.15.2",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://rpds.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/crate-py/rpds/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/crate-py/rpds"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/crate-py/rpds"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.15.2",
+      "type": "library",
+      "version": "0.15.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://www.grantjenks.com/docs/sortedcontainers/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache 2.0"
+          }
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Chat",
+          "type": "chat",
+          "url": "https://gitter.im/python/typing"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python/typeshed/issues"
+        },
+        {
+          "comment": "Project-URL: Changes",
+          "type": "other",
+          "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
+        },
+        {
+          "comment": "Project-URL: GitHub",
+          "type": "vcs",
+          "url": "https://github.com/python/typeshed"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/typeshed"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache-2.0 license"
+          }
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://gitlab.linss.com/open-source/python/uri-template"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT License"
+          }
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: documentation",
+          "type": "documentation",
+          "url": "https://webcolors.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://github.com/ubernostrum/webcolors"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp==3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/jaraco/zipp"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil==2.8.2",
+        "types-python-dateutil==2.8.19.14"
+      ],
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0"
+      ],
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema==4.20.0",
+        "license-expression==30.2.0",
+        "lxml==4.9.4",
+        "packageurl-python==0.13.1",
+        "py-serializable==0.16.0",
+        "sortedcontainers==2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib==6.0.0"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "dependsOn": [
+        "zipp==3.17.0"
+      ],
+      "ref": "importlib-resources==6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow==1.3.0"
+      ],
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources==6.1.1",
+        "referencing==0.32.0"
+      ],
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "fqdn==1.5.1",
+        "idna==3.6",
+        "importlib-resources==6.1.1",
+        "isoduration==20.11.0",
+        "jsonpointer==2.4",
+        "jsonschema-specifications==2023.11.2",
+        "referencing==0.32.0",
+        "rfc3339-validator==0.1.4",
+        "rfc3987==1.3.8",
+        "rpds-py==0.15.2",
+        "uri-template==1.3.0",
+        "webcolors==1.13"
+      ],
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "dependsOn": [
+        "boolean.py==4.0"
+      ],
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.4"
+    },
+    {
+      "ref": "packageurl-python==0.13.1"
+    },
+    {
+      "ref": "pkgutil_resolve_name==1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml==0.7.1"
+      ],
+      "ref": "py-serializable==0.16.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "rpds-py==0.15.2"
+      ],
+      "ref": "referencing==0.32.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.15.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    },
+    {
+      "ref": "zipp==3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
new file mode 100644
index 00000000..db5aa4d1
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
@@ -0,0 +1,778 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://arrow.readthedocs.io</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/arrow-py/arrow/issues</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/arrow-py/arrow</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://www.attrs.org/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-attrs/attrs/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-attrs/attrs</url>
+          <comment>Project-URL: Source Code</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/hynek</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="other">
+          <url>https://www.attrs.org/en/stable/changelog.html</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/bastikr/boolean.py</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==6.0.0">
+      <name>cyclonedx-python-lib</name>
+      <version>6.0.0</version>
+      <description>Python library for CycloneDX</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/cyclonedx-python-lib@6.0.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <licenses>
+        <license>
+          <id>Python-2.0</id>
+        </license>
+        <license>
+          <name>PSFL</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.python.org/pypi/defusedxml</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/tiran/defusedxml</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <licenses>
+        <license>
+          <name>MPL 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/ypcrts/fqdn</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/kjd/idna/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources==6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://importlib-resources.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/importlib_resources</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <licenses>
+        <license>
+          <id>ISC</id>
+        </license>
+        <license>
+          <name>UNKNOWN</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/bolsote/isoduration/issues</url>
+          <comment>Project-URL: Bug Reports</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901) </description>
+      <licenses>
+        <license>
+          <name>Modified BSD License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/stefankoegl/python-json-pointer</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://python-jsonschema.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://jsonschema-specifications.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/nexB/license-expression</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.4">
+      <name>lxml</name>
+      <version>4.9.4</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/lxml@4.9.4</purl>
+      <externalReferences>
+        <reference type="other">
+          <url>https://github.com/lxml/lxml</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://lxml.de/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.13.1">
+      <name>packageurl-python</name>
+      <version>0.13.1</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/packageurl-python@0.13.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/package-url/packageurl-python</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil_resolve_name==1.3.10">
+      <name>pkgutil_resolve_name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/graingert/pkgutil-resolve-name</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.16.0">
+      <name>py-serializable</name>
+      <version>0.16.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/py-serializable@0.16.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/madpah/serializable/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <licenses>
+        <license>
+          <name>Dual License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://dateutil.readthedocs.io/en/stable/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing==0.32.0">
+      <name>referencing</name>
+      <version>0.32.0</version>
+      <description>JSON Referencing + Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/referencing@0.32.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://referencing.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/referencing/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/naimetti/rfc3339-validator</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <licenses>
+        <license>
+          <id>GPL-3.0-or-later</id>
+        </license>
+        <license>
+          <name>GNU GPLv3+</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/dgerber/rfc3987</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>http://pypi.python.org/pypi/rfc3987</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.15.2">
+      <name>rpds-py</name>
+      <version>0.15.2</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rpds-py@0.15.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://rpds.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/crate-py/rpds/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <licenses>
+        <license>
+          <name>Apache 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <licenses>
+        <license>
+          <name>Apache-2.0 license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="chat">
+          <url>https://gitter.im/python/typing</url>
+          <comment>Project-URL: Chat</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python/typeshed/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
+          <comment>Project-URL: Changes</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Project-URL: GitHub</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://gitlab.linss.com/open-source/python/uri-template</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://webcolors.readthedocs.io</url>
+          <comment>Project-URL: documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/ubernostrum/webcolors</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp==3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/jaraco/zipp</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0">
+      <dependency ref="python-dateutil==2.8.2"/>
+      <dependency ref="types-python-dateutil==2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs==23.1.0">
+      <dependency ref="attrs==23.1.0"/>
+    </dependency>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==6.0.0">
+      <dependency ref="jsonschema==4.20.0"/>
+      <dependency ref="license-expression==30.2.0"/>
+      <dependency ref="lxml==4.9.4"/>
+      <dependency ref="packageurl-python==0.13.1"/>
+      <dependency ref="py-serializable==0.16.0"/>
+      <dependency ref="sortedcontainers==2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="importlib-resources==6.1.1">
+      <dependency ref="zipp==3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration==20.11.0">
+      <dependency ref="arrow==1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2">
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="referencing==0.32.0"/>
+    </dependency>
+    <dependency ref="jsonschema==4.20.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="fqdn==1.5.1"/>
+      <dependency ref="idna==3.6"/>
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="isoduration==20.11.0"/>
+      <dependency ref="jsonpointer==2.4"/>
+      <dependency ref="jsonschema-specifications==2023.11.2"/>
+      <dependency ref="referencing==0.32.0"/>
+      <dependency ref="rfc3339-validator==0.1.4"/>
+      <dependency ref="rfc3987==1.3.8"/>
+      <dependency ref="rpds-py==0.15.2"/>
+      <dependency ref="uri-template==1.3.0"/>
+      <dependency ref="webcolors==1.13"/>
+    </dependency>
+    <dependency ref="license-expression==30.2.0">
+      <dependency ref="boolean.py==4.0"/>
+    </dependency>
+    <dependency ref="lxml==4.9.4"/>
+    <dependency ref="packageurl-python==0.13.1"/>
+    <dependency ref="pkgutil_resolve_name==1.3.10"/>
+    <dependency ref="py-serializable==0.16.0">
+      <dependency ref="defusedxml==0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil==2.8.2">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="referencing==0.32.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="rpds-py==0.15.2"/>
+    </dependency>
+    <dependency ref="rfc3339-validator==0.1.4">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.15.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+    <dependency ref="zipp==3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
new file mode 100644
index 00000000..dfcfa12d
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
@@ -0,0 +1,1045 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://arrow.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/arrow-py/arrow/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/arrow-py/arrow"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://www.attrs.org/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-attrs/attrs/issues"
+        },
+        {
+          "comment": "Project-URL: Source Code",
+          "type": "other",
+          "url": "https://github.com/python-attrs/attrs"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/hynek"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://www.attrs.org/en/stable/changelog.html"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bastikr/boolean.py"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-2-Clause"
+          }
+        }
+      ],
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==6.0.0",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://cyclonedx-python-library.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@6.0.0",
+      "type": "library",
+      "version": "6.0.0"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://pypi.python.org/pypi/defusedxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/tiran/defusedxml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Python-2.0"
+          }
+        },
+        {
+          "license": {
+            "name": "PSFL"
+          }
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/ypcrts/fqdn"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "MPL 2.0"
+          }
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/kjd/idna/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/kjd/idna"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "importlib-resources==6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://importlib-resources.readthedocs.io/"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/importlib_resources"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Reports",
+          "type": "issue-tracker",
+          "url": "https://github.com/bolsote/isoduration/issues"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/bolsote/isoduration"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bolsote/isoduration"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "ISC"
+          }
+        },
+        {
+          "license": {
+            "name": "UNKNOWN"
+          }
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901) ",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/stefankoegl/python-json-pointer"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Modified BSD License"
+          }
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://python-jsonschema.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://jsonschema-specifications.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/nexB/license-expression"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.4",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/lxml/lxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://lxml.de/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.4",
+      "type": "library",
+      "version": "4.9.4"
+    },
+    {
+      "bom-ref": "packageurl-python==0.13.1",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/package-url/packageurl-python"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.13.1",
+      "type": "library",
+      "version": "0.13.1"
+    },
+    {
+      "bom-ref": "pkgutil_resolve_name==1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/graingert/pkgutil-resolve-name"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "pkgutil_resolve_name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable==0.16.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/madpah/serializable/issues"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/madpah/serializable"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/madpah/serializable"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.16.0",
+      "type": "library",
+      "version": "0.16.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://dateutil.readthedocs.io/en/stable/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/dateutil/dateutil"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/dateutil/dateutil"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Dual License"
+          }
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.32.0",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://referencing.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/referencing/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/referencing"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/referencing"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.32.0",
+      "type": "library",
+      "version": "0.32.0"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/naimetti/rfc3339-validator"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT license"
+          }
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://github.com/dgerber/rfc3987"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://pypi.python.org/pypi/rfc3987"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-3.0-or-later"
+          }
+        },
+        {
+          "license": {
+            "name": "GNU GPLv3+"
+          }
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.15.2",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://rpds.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/crate-py/rpds/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/crate-py/rpds"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/crate-py/rpds"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.15.2",
+      "type": "library",
+      "version": "0.15.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://www.grantjenks.com/docs/sortedcontainers/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache 2.0"
+          }
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Chat",
+          "type": "chat",
+          "url": "https://gitter.im/python/typing"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python/typeshed/issues"
+        },
+        {
+          "comment": "Project-URL: Changes",
+          "type": "release-notes",
+          "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
+        },
+        {
+          "comment": "Project-URL: GitHub",
+          "type": "vcs",
+          "url": "https://github.com/python/typeshed"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/typeshed"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache-2.0 license"
+          }
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://gitlab.linss.com/open-source/python/uri-template"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT License"
+          }
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: documentation",
+          "type": "documentation",
+          "url": "https://webcolors.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://github.com/ubernostrum/webcolors"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp==3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/jaraco/zipp"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil==2.8.2",
+        "types-python-dateutil==2.8.19.14"
+      ],
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0"
+      ],
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema==4.20.0",
+        "license-expression==30.2.0",
+        "lxml==4.9.4",
+        "packageurl-python==0.13.1",
+        "py-serializable==0.16.0",
+        "sortedcontainers==2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib==6.0.0"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "dependsOn": [
+        "zipp==3.17.0"
+      ],
+      "ref": "importlib-resources==6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow==1.3.0"
+      ],
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources==6.1.1",
+        "referencing==0.32.0"
+      ],
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "fqdn==1.5.1",
+        "idna==3.6",
+        "importlib-resources==6.1.1",
+        "isoduration==20.11.0",
+        "jsonpointer==2.4",
+        "jsonschema-specifications==2023.11.2",
+        "referencing==0.32.0",
+        "rfc3339-validator==0.1.4",
+        "rfc3987==1.3.8",
+        "rpds-py==0.15.2",
+        "uri-template==1.3.0",
+        "webcolors==1.13"
+      ],
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "dependsOn": [
+        "boolean.py==4.0"
+      ],
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.4"
+    },
+    {
+      "ref": "packageurl-python==0.13.1"
+    },
+    {
+      "ref": "pkgutil_resolve_name==1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml==0.7.1"
+      ],
+      "ref": "py-serializable==0.16.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "rpds-py==0.15.2"
+      ],
+      "ref": "referencing==0.32.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.15.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    },
+    {
+      "ref": "zipp==3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
new file mode 100644
index 00000000..17fb8afa
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
@@ -0,0 +1,805 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://arrow.readthedocs.io</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/arrow-py/arrow/issues</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/arrow-py/arrow</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://www.attrs.org/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-attrs/attrs/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-attrs/attrs</url>
+          <comment>Project-URL: Source Code</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/hynek</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://www.attrs.org/en/stable/changelog.html</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/bastikr/boolean.py</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==6.0.0">
+      <name>cyclonedx-python-lib</name>
+      <version>6.0.0</version>
+      <description>Python library for CycloneDX</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/cyclonedx-python-lib@6.0.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <licenses>
+        <license>
+          <id>Python-2.0</id>
+        </license>
+        <license>
+          <name>PSFL</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.python.org/pypi/defusedxml</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/tiran/defusedxml</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <licenses>
+        <license>
+          <name>MPL 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/ypcrts/fqdn</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/kjd/idna/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources==6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://importlib-resources.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/importlib_resources</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <licenses>
+        <license>
+          <id>ISC</id>
+        </license>
+        <license>
+          <name>UNKNOWN</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/bolsote/isoduration/issues</url>
+          <comment>Project-URL: Bug Reports</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901) </description>
+      <licenses>
+        <license>
+          <name>Modified BSD License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/stefankoegl/python-json-pointer</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://python-jsonschema.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://jsonschema-specifications.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/nexB/license-expression</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.4">
+      <name>lxml</name>
+      <version>4.9.4</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/lxml@4.9.4</purl>
+      <externalReferences>
+        <reference type="other">
+          <url>https://github.com/lxml/lxml</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://lxml.de/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.13.1">
+      <name>packageurl-python</name>
+      <version>0.13.1</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/packageurl-python@0.13.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/package-url/packageurl-python</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil_resolve_name==1.3.10">
+      <name>pkgutil_resolve_name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/graingert/pkgutil-resolve-name</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.16.0">
+      <name>py-serializable</name>
+      <version>0.16.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/py-serializable@0.16.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/madpah/serializable/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <licenses>
+        <license>
+          <name>Dual License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://dateutil.readthedocs.io/en/stable/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing==0.32.0">
+      <name>referencing</name>
+      <version>0.32.0</version>
+      <description>JSON Referencing + Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/referencing@0.32.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://referencing.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/referencing/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/naimetti/rfc3339-validator</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <licenses>
+        <license>
+          <id>GPL-3.0-or-later</id>
+        </license>
+        <license>
+          <name>GNU GPLv3+</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/dgerber/rfc3987</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>http://pypi.python.org/pypi/rfc3987</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.15.2">
+      <name>rpds-py</name>
+      <version>0.15.2</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rpds-py@0.15.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://rpds.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/crate-py/rpds/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <licenses>
+        <license>
+          <name>Apache 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <licenses>
+        <license>
+          <name>Apache-2.0 license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="chat">
+          <url>https://gitter.im/python/typing</url>
+          <comment>Project-URL: Chat</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python/typeshed/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
+          <comment>Project-URL: Changes</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Project-URL: GitHub</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://gitlab.linss.com/open-source/python/uri-template</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://webcolors.readthedocs.io</url>
+          <comment>Project-URL: documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/ubernostrum/webcolors</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp==3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/jaraco/zipp</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0">
+      <dependency ref="python-dateutil==2.8.2"/>
+      <dependency ref="types-python-dateutil==2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs==23.1.0">
+      <dependency ref="attrs==23.1.0"/>
+    </dependency>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==6.0.0">
+      <dependency ref="jsonschema==4.20.0"/>
+      <dependency ref="license-expression==30.2.0"/>
+      <dependency ref="lxml==4.9.4"/>
+      <dependency ref="packageurl-python==0.13.1"/>
+      <dependency ref="py-serializable==0.16.0"/>
+      <dependency ref="sortedcontainers==2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="importlib-resources==6.1.1">
+      <dependency ref="zipp==3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration==20.11.0">
+      <dependency ref="arrow==1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2">
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="referencing==0.32.0"/>
+    </dependency>
+    <dependency ref="jsonschema==4.20.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="fqdn==1.5.1"/>
+      <dependency ref="idna==3.6"/>
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="isoduration==20.11.0"/>
+      <dependency ref="jsonpointer==2.4"/>
+      <dependency ref="jsonschema-specifications==2023.11.2"/>
+      <dependency ref="referencing==0.32.0"/>
+      <dependency ref="rfc3339-validator==0.1.4"/>
+      <dependency ref="rfc3987==1.3.8"/>
+      <dependency ref="rpds-py==0.15.2"/>
+      <dependency ref="uri-template==1.3.0"/>
+      <dependency ref="webcolors==1.13"/>
+    </dependency>
+    <dependency ref="license-expression==30.2.0">
+      <dependency ref="boolean.py==4.0"/>
+    </dependency>
+    <dependency ref="lxml==4.9.4"/>
+    <dependency ref="packageurl-python==0.13.1"/>
+    <dependency ref="pkgutil_resolve_name==1.3.10"/>
+    <dependency ref="py-serializable==0.16.0">
+      <dependency ref="defusedxml==0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil==2.8.2">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="referencing==0.32.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="rpds-py==0.15.2"/>
+    </dependency>
+    <dependency ref="rfc3339-validator==0.1.4">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.15.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+    <dependency ref="zipp==3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
new file mode 100644
index 00000000..3b4c2ede
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
@@ -0,0 +1,1045 @@
+{
+  "components": [
+    {
+      "bom-ref": "arrow==1.3.0",
+      "description": "Better dates & times for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://arrow.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/arrow-py/arrow/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/arrow-py/arrow"
+        }
+      ],
+      "name": "arrow",
+      "purl": "pkg:pypi/arrow@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "attrs==23.1.0",
+      "description": "Classes Without Boilerplate",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://www.attrs.org/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-attrs/attrs/issues"
+        },
+        {
+          "comment": "Project-URL: Source Code",
+          "type": "other",
+          "url": "https://github.com/python-attrs/attrs"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/hynek"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://www.attrs.org/en/stable/changelog.html"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "attrs",
+      "purl": "pkg:pypi/attrs@23.1.0",
+      "type": "library",
+      "version": "23.1.0"
+    },
+    {
+      "bom-ref": "boolean.py==4.0",
+      "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bastikr/boolean.py"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-2-Clause"
+          }
+        }
+      ],
+      "name": "boolean.py",
+      "purl": "pkg:pypi/boolean.py@4.0",
+      "type": "library",
+      "version": "4.0"
+    },
+    {
+      "bom-ref": "cyclonedx-python-lib==6.0.0",
+      "description": "Python library for CycloneDX",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://cyclonedx-python-library.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "cyclonedx-python-lib",
+      "purl": "pkg:pypi/cyclonedx-python-lib@6.0.0",
+      "type": "library",
+      "version": "6.0.0"
+    },
+    {
+      "bom-ref": "defusedxml==0.7.1",
+      "description": "XML bomb protection for Python stdlib modules",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://pypi.python.org/pypi/defusedxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/tiran/defusedxml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Python-2.0"
+          }
+        },
+        {
+          "license": {
+            "name": "PSFL"
+          }
+        }
+      ],
+      "name": "defusedxml",
+      "purl": "pkg:pypi/defusedxml@0.7.1",
+      "type": "library",
+      "version": "0.7.1"
+    },
+    {
+      "bom-ref": "fqdn==1.5.1",
+      "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/ypcrts/fqdn"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "MPL 2.0"
+          }
+        }
+      ],
+      "name": "fqdn",
+      "purl": "pkg:pypi/fqdn@1.5.1",
+      "type": "library",
+      "version": "1.5.1"
+    },
+    {
+      "bom-ref": "idna==3.6",
+      "description": "Internationalized Domain Names in Applications (IDNA)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/kjd/idna/issues"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/kjd/idna"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
+        }
+      ],
+      "name": "idna",
+      "purl": "pkg:pypi/idna@3.6",
+      "type": "library",
+      "version": "3.6"
+    },
+    {
+      "bom-ref": "importlib-resources==6.1.1",
+      "description": "Read resources from Python packages",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://importlib-resources.readthedocs.io/"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/importlib_resources"
+        }
+      ],
+      "name": "importlib-resources",
+      "purl": "pkg:pypi/importlib-resources@6.1.1",
+      "type": "library",
+      "version": "6.1.1"
+    },
+    {
+      "bom-ref": "isoduration==20.11.0",
+      "description": "Operations with ISO 8601 durations",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Reports",
+          "type": "issue-tracker",
+          "url": "https://github.com/bolsote/isoduration/issues"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/bolsote/isoduration"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/bolsote/isoduration"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "ISC"
+          }
+        },
+        {
+          "license": {
+            "name": "UNKNOWN"
+          }
+        }
+      ],
+      "name": "isoduration",
+      "purl": "pkg:pypi/isoduration@20.11.0",
+      "type": "library",
+      "version": "20.11.0"
+    },
+    {
+      "bom-ref": "jsonpointer==2.4",
+      "description": "Identify specific nodes in a JSON document (RFC 6901) ",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/stefankoegl/python-json-pointer"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Modified BSD License"
+          }
+        }
+      ],
+      "name": "jsonpointer",
+      "purl": "pkg:pypi/jsonpointer@2.4",
+      "type": "library",
+      "version": "2.4"
+    },
+    {
+      "bom-ref": "jsonschema==4.20.0",
+      "description": "An implementation of JSON Schema validation for Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://python-jsonschema.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Changelog",
+          "type": "release-notes",
+          "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema",
+      "purl": "pkg:pypi/jsonschema@4.20.0",
+      "type": "library",
+      "version": "4.20.0"
+    },
+    {
+      "bom-ref": "jsonschema-specifications==2023.11.2",
+      "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://jsonschema-specifications.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/jsonschema-specifications"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "jsonschema-specifications",
+      "purl": "pkg:pypi/jsonschema-specifications@2023.11.2",
+      "type": "library",
+      "version": "2023.11.2"
+    },
+    {
+      "bom-ref": "license-expression==30.2.0",
+      "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/nexB/license-expression"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "license-expression",
+      "purl": "pkg:pypi/license-expression@30.2.0",
+      "type": "library",
+      "version": "30.2.0"
+    },
+    {
+      "bom-ref": "lxml==4.9.4",
+      "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/lxml/lxml"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://lxml.de/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "lxml",
+      "purl": "pkg:pypi/lxml@4.9.4",
+      "type": "library",
+      "version": "4.9.4"
+    },
+    {
+      "bom-ref": "packageurl-python==0.13.1",
+      "description": "A purl aka. Package URL parser and builder",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/package-url/packageurl-python"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "packageurl-python",
+      "purl": "pkg:pypi/packageurl-python@0.13.1",
+      "type": "library",
+      "version": "0.13.1"
+    },
+    {
+      "bom-ref": "pkgutil_resolve_name==1.3.10",
+      "description": "Resolve a name to an object.",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/graingert/pkgutil-resolve-name"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "pkgutil_resolve_name",
+      "purl": "pkg:pypi/pkgutil-resolve-name@1.3.10",
+      "type": "library",
+      "version": "1.3.10"
+    },
+    {
+      "bom-ref": "py-serializable==0.16.0",
+      "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/madpah/serializable/issues"
+        },
+        {
+          "comment": "Project-URL: Repository",
+          "type": "vcs",
+          "url": "https://github.com/madpah/serializable"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/madpah/serializable"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "name": "py-serializable",
+      "purl": "pkg:pypi/py-serializable@0.16.0",
+      "type": "library",
+      "version": "0.16.0"
+    },
+    {
+      "bom-ref": "python-dateutil==2.8.2",
+      "description": "Extensions to the standard Python datetime module",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://dateutil.readthedocs.io/en/stable/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/dateutil/dateutil"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/dateutil/dateutil"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Dual License"
+          }
+        }
+      ],
+      "name": "python-dateutil",
+      "purl": "pkg:pypi/python-dateutil@2.8.2",
+      "type": "library",
+      "version": "2.8.2"
+    },
+    {
+      "bom-ref": "referencing==0.32.0",
+      "description": "JSON Referencing + Python",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://referencing.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/python-jsonschema/referencing/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/python-jsonschema/referencing"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/python-jsonschema/referencing"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "referencing",
+      "purl": "pkg:pypi/referencing@0.32.0",
+      "type": "library",
+      "version": "0.32.0"
+    },
+    {
+      "bom-ref": "rfc3339-validator==0.1.4",
+      "description": "A pure python RFC3339 validator",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/naimetti/rfc3339-validator"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT license"
+          }
+        }
+      ],
+      "name": "rfc3339-validator",
+      "purl": "pkg:pypi/rfc3339-validator@0.1.4",
+      "type": "library",
+      "version": "0.1.4"
+    },
+    {
+      "bom-ref": "rfc3987==1.3.8",
+      "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
+      "externalReferences": [
+        {
+          "comment": "Download-URL",
+          "type": "distribution",
+          "url": "https://github.com/dgerber/rfc3987"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://pypi.python.org/pypi/rfc3987"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "GPL-3.0-or-later"
+          }
+        },
+        {
+          "license": {
+            "name": "GNU GPLv3+"
+          }
+        }
+      ],
+      "name": "rfc3987",
+      "purl": "pkg:pypi/rfc3987@1.3.8",
+      "type": "library",
+      "version": "1.3.8"
+    },
+    {
+      "bom-ref": "rpds-py==0.15.2",
+      "description": "Python bindings to Rust's persistent data structures (rpds)",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://rpds.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issues",
+          "type": "issue-tracker",
+          "url": "https://github.com/crate-py/rpds/issues/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/crate-py/rpds"
+        },
+        {
+          "comment": "Project-URL: Funding",
+          "type": "other",
+          "url": "https://github.com/sponsors/Julian"
+        },
+        {
+          "comment": "Project-URL: Tidelift",
+          "type": "other",
+          "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
+        },
+        {
+          "comment": "Project-URL: Homepage",
+          "type": "website",
+          "url": "https://github.com/crate-py/rpds"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "rpds-py",
+      "purl": "pkg:pypi/rpds-py@0.15.2",
+      "type": "library",
+      "version": "0.15.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "sortedcontainers==2.4.0",
+      "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "http://www.grantjenks.com/docs/sortedcontainers/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache 2.0"
+          }
+        }
+      ],
+      "name": "sortedcontainers",
+      "purl": "pkg:pypi/sortedcontainers@2.4.0",
+      "type": "library",
+      "version": "2.4.0"
+    },
+    {
+      "bom-ref": "types-python-dateutil==2.8.19.14",
+      "description": "Typing stubs for python-dateutil",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: Chat",
+          "type": "chat",
+          "url": "https://gitter.im/python/typing"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/python/typeshed/issues"
+        },
+        {
+          "comment": "Project-URL: Changes",
+          "type": "release-notes",
+          "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
+        },
+        {
+          "comment": "Project-URL: GitHub",
+          "type": "vcs",
+          "url": "https://github.com/python/typeshed"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/python/typeshed"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "name": "Apache-2.0 license"
+          }
+        }
+      ],
+      "name": "types-python-dateutil",
+      "purl": "pkg:pypi/types-python-dateutil@2.8.19.14",
+      "type": "library",
+      "version": "2.8.19.14"
+    },
+    {
+      "bom-ref": "uri-template==1.3.0",
+      "description": "RFC 6570 URI Template Processor",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://gitlab.linss.com/open-source/python/uri-template"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        },
+        {
+          "license": {
+            "name": "MIT License"
+          }
+        }
+      ],
+      "name": "uri-template",
+      "purl": "pkg:pypi/uri-template@1.3.0",
+      "type": "library",
+      "version": "1.3.0"
+    },
+    {
+      "bom-ref": "webcolors==1.13",
+      "description": "A library for working with the color formats defined by HTML and CSS.",
+      "externalReferences": [
+        {
+          "comment": "Project-URL: documentation",
+          "type": "documentation",
+          "url": "https://webcolors.readthedocs.io"
+        },
+        {
+          "comment": "Project-URL: homepage",
+          "type": "website",
+          "url": "https://github.com/ubernostrum/webcolors"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-3-Clause"
+          }
+        }
+      ],
+      "name": "webcolors",
+      "purl": "pkg:pypi/webcolors@1.13",
+      "type": "library",
+      "version": "1.13"
+    },
+    {
+      "bom-ref": "zipp==3.17.0",
+      "description": "Backport of pathlib-compatible object wrapper for zip files",
+      "externalReferences": [
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/jaraco/zipp"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "zipp",
+      "purl": "pkg:pypi/zipp@3.17.0",
+      "type": "library",
+      "version": "3.17.0"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "python-dateutil==2.8.2",
+        "types-python-dateutil==2.8.19.14"
+      ],
+      "ref": "arrow==1.3.0"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0"
+      ],
+      "ref": "attrs==23.1.0"
+    },
+    {
+      "ref": "boolean.py==4.0"
+    },
+    {
+      "dependsOn": [
+        "jsonschema==4.20.0",
+        "license-expression==30.2.0",
+        "lxml==4.9.4",
+        "packageurl-python==0.13.1",
+        "py-serializable==0.16.0",
+        "sortedcontainers==2.4.0"
+      ],
+      "ref": "cyclonedx-python-lib==6.0.0"
+    },
+    {
+      "ref": "defusedxml==0.7.1"
+    },
+    {
+      "ref": "fqdn==1.5.1"
+    },
+    {
+      "ref": "idna==3.6"
+    },
+    {
+      "dependsOn": [
+        "zipp==3.17.0"
+      ],
+      "ref": "importlib-resources==6.1.1"
+    },
+    {
+      "dependsOn": [
+        "arrow==1.3.0"
+      ],
+      "ref": "isoduration==20.11.0"
+    },
+    {
+      "ref": "jsonpointer==2.4"
+    },
+    {
+      "dependsOn": [
+        "importlib-resources==6.1.1",
+        "referencing==0.32.0"
+      ],
+      "ref": "jsonschema-specifications==2023.11.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "fqdn==1.5.1",
+        "idna==3.6",
+        "importlib-resources==6.1.1",
+        "isoduration==20.11.0",
+        "jsonpointer==2.4",
+        "jsonschema-specifications==2023.11.2",
+        "referencing==0.32.0",
+        "rfc3339-validator==0.1.4",
+        "rfc3987==1.3.8",
+        "rpds-py==0.15.2",
+        "uri-template==1.3.0",
+        "webcolors==1.13"
+      ],
+      "ref": "jsonschema==4.20.0"
+    },
+    {
+      "dependsOn": [
+        "boolean.py==4.0"
+      ],
+      "ref": "license-expression==30.2.0"
+    },
+    {
+      "ref": "lxml==4.9.4"
+    },
+    {
+      "ref": "packageurl-python==0.13.1"
+    },
+    {
+      "ref": "pkgutil_resolve_name==1.3.10"
+    },
+    {
+      "dependsOn": [
+        "defusedxml==0.7.1"
+      ],
+      "ref": "py-serializable==0.16.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "python-dateutil==2.8.2"
+    },
+    {
+      "dependsOn": [
+        "attrs==23.1.0",
+        "rpds-py==0.15.2"
+      ],
+      "ref": "referencing==0.32.0"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "rfc3339-validator==0.1.4"
+    },
+    {
+      "ref": "rfc3987==1.3.8"
+    },
+    {
+      "ref": "root-component"
+    },
+    {
+      "ref": "rpds-py==0.15.2"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "sortedcontainers==2.4.0"
+    },
+    {
+      "ref": "types-python-dateutil==2.8.19.14"
+    },
+    {
+      "ref": "uri-template==1.3.0"
+    },
+    {
+      "ref": "webcolors==1.13"
+    },
+    {
+      "ref": "zipp==3.17.0"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, but no deps",
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "no-deps",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
new file mode 100644
index 00000000..9e56e5c9
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
@@ -0,0 +1,805 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>no-deps</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, but no deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="arrow==1.3.0">
+      <name>arrow</name>
+      <version>1.3.0</version>
+      <description>Better dates &amp; times for Python</description>
+      <purl>pkg:pypi/arrow@1.3.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://arrow.readthedocs.io</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/arrow-py/arrow/issues</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/arrow-py/arrow</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="attrs==23.1.0">
+      <name>attrs</name>
+      <version>23.1.0</version>
+      <description>Classes Without Boilerplate</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/attrs@23.1.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://www.attrs.org/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-attrs/attrs/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-attrs/attrs</url>
+          <comment>Project-URL: Source Code</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/hynek</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://www.attrs.org/en/stable/changelog.html</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="boolean.py==4.0">
+      <name>boolean.py</name>
+      <version>4.0</version>
+      <description>Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.</description>
+      <licenses>
+        <license>
+          <id>BSD-2-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/boolean.py@4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/bastikr/boolean.py</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="cyclonedx-python-lib==6.0.0">
+      <name>cyclonedx-python-lib</name>
+      <version>6.0.0</version>
+      <description>Python library for CycloneDX</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/cyclonedx-python-lib@6.0.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://cyclonedx-python-library.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="defusedxml==0.7.1">
+      <name>defusedxml</name>
+      <version>0.7.1</version>
+      <description>XML bomb protection for Python stdlib modules</description>
+      <licenses>
+        <license>
+          <id>Python-2.0</id>
+        </license>
+        <license>
+          <name>PSFL</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/defusedxml@0.7.1</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://pypi.python.org/pypi/defusedxml</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/tiran/defusedxml</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="fqdn==1.5.1">
+      <name>fqdn</name>
+      <version>1.5.1</version>
+      <description>Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers</description>
+      <licenses>
+        <license>
+          <name>MPL 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/fqdn@1.5.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/ypcrts/fqdn</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="idna==3.6">
+      <name>idna</name>
+      <version>3.6</version>
+      <description>Internationalized Domain Names in Applications (IDNA)</description>
+      <purl>pkg:pypi/idna@3.6</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/kjd/idna/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/kjd/idna</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="importlib-resources==6.1.1">
+      <name>importlib-resources</name>
+      <version>6.1.1</version>
+      <description>Read resources from Python packages</description>
+      <purl>pkg:pypi/importlib-resources@6.1.1</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://importlib-resources.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/importlib_resources</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="isoduration==20.11.0">
+      <name>isoduration</name>
+      <version>20.11.0</version>
+      <description>Operations with ISO 8601 durations</description>
+      <licenses>
+        <license>
+          <id>ISC</id>
+        </license>
+        <license>
+          <name>UNKNOWN</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/isoduration@20.11.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/bolsote/isoduration/issues</url>
+          <comment>Project-URL: Bug Reports</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/bolsote/isoduration</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonpointer==2.4">
+      <name>jsonpointer</name>
+      <version>2.4</version>
+      <description>Identify specific nodes in a JSON document (RFC 6901) </description>
+      <licenses>
+        <license>
+          <name>Modified BSD License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonpointer@2.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/stefankoegl/python-json-pointer</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema==4.20.0">
+      <name>jsonschema</name>
+      <version>4.20.0</version>
+      <description>An implementation of JSON Schema validation for Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema@4.20.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://python-jsonschema.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
+          <comment>Project-URL: Changelog</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
+      <name>jsonschema-specifications</name>
+      <version>2023.11.2</version>
+      <description>The JSON Schema meta-schemas and vocabularies, exposed as a Registry</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/jsonschema-specifications@2023.11.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://jsonschema-specifications.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="license-expression==30.2.0">
+      <name>license-expression</name>
+      <version>30.2.0</version>
+      <description>license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/license-expression@30.2.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/nexB/license-expression</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="lxml==4.9.4">
+      <name>lxml</name>
+      <version>4.9.4</version>
+      <description>Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/lxml@4.9.4</purl>
+      <externalReferences>
+        <reference type="other">
+          <url>https://github.com/lxml/lxml</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://lxml.de/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="packageurl-python==0.13.1">
+      <name>packageurl-python</name>
+      <version>0.13.1</version>
+      <description>A purl aka. Package URL parser and builder</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/packageurl-python@0.13.1</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/package-url/packageurl-python</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="pkgutil_resolve_name==1.3.10">
+      <name>pkgutil_resolve_name</name>
+      <version>1.3.10</version>
+      <description>Resolve a name to an object.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/pkgutil-resolve-name@1.3.10</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/graingert/pkgutil-resolve-name</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="py-serializable==0.16.0">
+      <name>py-serializable</name>
+      <version>0.16.0</version>
+      <description>Library for serializing and deserializing Python Objects to and from JSON and XML.</description>
+      <licenses>
+        <license>
+          <id>Apache-2.0</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/py-serializable@0.16.0</purl>
+      <externalReferences>
+        <reference type="issue-tracker">
+          <url>https://github.com/madpah/serializable/issues</url>
+          <comment>Project-URL: Bug Tracker</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Project-URL: Repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/madpah/serializable</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="python-dateutil==2.8.2">
+      <name>python-dateutil</name>
+      <version>2.8.2</version>
+      <description>Extensions to the standard Python datetime module</description>
+      <licenses>
+        <license>
+          <name>Dual License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/python-dateutil@2.8.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://dateutil.readthedocs.io/en/stable/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/dateutil/dateutil</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="referencing==0.32.0">
+      <name>referencing</name>
+      <version>0.32.0</version>
+      <description>JSON Referencing + Python</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/referencing@0.32.0</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://referencing.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python-jsonschema/referencing/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python-jsonschema/referencing</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3339-validator==0.1.4">
+      <name>rfc3339-validator</name>
+      <version>0.1.4</version>
+      <description>A pure python RFC3339 validator</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3339-validator@0.1.4</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/naimetti/rfc3339-validator</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rfc3987==1.3.8">
+      <name>rfc3987</name>
+      <version>1.3.8</version>
+      <description>Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)</description>
+      <licenses>
+        <license>
+          <id>GPL-3.0-or-later</id>
+        </license>
+        <license>
+          <name>GNU GPLv3+</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rfc3987@1.3.8</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/dgerber/rfc3987</url>
+          <comment>Download-URL</comment>
+        </reference>
+        <reference type="website">
+          <url>http://pypi.python.org/pypi/rfc3987</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="rpds-py==0.15.2">
+      <name>rpds-py</name>
+      <version>0.15.2</version>
+      <description>Python bindings to Rust's persistent data structures (rpds)</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/rpds-py@0.15.2</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://rpds.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/crate-py/rpds/issues/</url>
+          <comment>Project-URL: Issues</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/sponsors/Julian</url>
+          <comment>Project-URL: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
+          <comment>Project-URL: Tidelift</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/crate-py/rpds</url>
+          <comment>Project-URL: Homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="sortedcontainers==2.4.0">
+      <name>sortedcontainers</name>
+      <version>2.4.0</version>
+      <description>Sorted Containers -- Sorted List, Sorted Dict, Sorted Set</description>
+      <licenses>
+        <license>
+          <name>Apache 2.0</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/sortedcontainers@2.4.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="types-python-dateutil==2.8.19.14">
+      <name>types-python-dateutil</name>
+      <version>2.8.19.14</version>
+      <description>Typing stubs for python-dateutil</description>
+      <licenses>
+        <license>
+          <name>Apache-2.0 license</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/types-python-dateutil@2.8.19.14</purl>
+      <externalReferences>
+        <reference type="chat">
+          <url>https://gitter.im/python/typing</url>
+          <comment>Project-URL: Chat</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/python/typeshed/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
+          <comment>Project-URL: Changes</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Project-URL: GitHub</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/python/typeshed</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="uri-template==1.3.0">
+      <name>uri-template</name>
+      <version>1.3.0</version>
+      <description>RFC 6570 URI Template Processor</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+        <license>
+          <name>MIT License</name>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/uri-template@1.3.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://gitlab.linss.com/open-source/python/uri-template</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="webcolors==1.13">
+      <name>webcolors</name>
+      <version>1.13</version>
+      <description>A library for working with the color formats defined by HTML and CSS.</description>
+      <licenses>
+        <license>
+          <id>BSD-3-Clause</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/webcolors@1.13</purl>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://webcolors.readthedocs.io</url>
+          <comment>Project-URL: documentation</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/ubernostrum/webcolors</url>
+          <comment>Project-URL: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="zipp==3.17.0">
+      <name>zipp</name>
+      <version>3.17.0</version>
+      <description>Backport of pathlib-compatible object wrapper for zip files</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/zipp@3.17.0</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/jaraco/zipp</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="arrow==1.3.0">
+      <dependency ref="python-dateutil==2.8.2"/>
+      <dependency ref="types-python-dateutil==2.8.19.14"/>
+    </dependency>
+    <dependency ref="attrs==23.1.0">
+      <dependency ref="attrs==23.1.0"/>
+    </dependency>
+    <dependency ref="boolean.py==4.0"/>
+    <dependency ref="cyclonedx-python-lib==6.0.0">
+      <dependency ref="jsonschema==4.20.0"/>
+      <dependency ref="license-expression==30.2.0"/>
+      <dependency ref="lxml==4.9.4"/>
+      <dependency ref="packageurl-python==0.13.1"/>
+      <dependency ref="py-serializable==0.16.0"/>
+      <dependency ref="sortedcontainers==2.4.0"/>
+    </dependency>
+    <dependency ref="defusedxml==0.7.1"/>
+    <dependency ref="fqdn==1.5.1"/>
+    <dependency ref="idna==3.6"/>
+    <dependency ref="importlib-resources==6.1.1">
+      <dependency ref="zipp==3.17.0"/>
+    </dependency>
+    <dependency ref="isoduration==20.11.0">
+      <dependency ref="arrow==1.3.0"/>
+    </dependency>
+    <dependency ref="jsonpointer==2.4"/>
+    <dependency ref="jsonschema-specifications==2023.11.2">
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="referencing==0.32.0"/>
+    </dependency>
+    <dependency ref="jsonschema==4.20.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="fqdn==1.5.1"/>
+      <dependency ref="idna==3.6"/>
+      <dependency ref="importlib-resources==6.1.1"/>
+      <dependency ref="isoduration==20.11.0"/>
+      <dependency ref="jsonpointer==2.4"/>
+      <dependency ref="jsonschema-specifications==2023.11.2"/>
+      <dependency ref="referencing==0.32.0"/>
+      <dependency ref="rfc3339-validator==0.1.4"/>
+      <dependency ref="rfc3987==1.3.8"/>
+      <dependency ref="rpds-py==0.15.2"/>
+      <dependency ref="uri-template==1.3.0"/>
+      <dependency ref="webcolors==1.13"/>
+    </dependency>
+    <dependency ref="license-expression==30.2.0">
+      <dependency ref="boolean.py==4.0"/>
+    </dependency>
+    <dependency ref="lxml==4.9.4"/>
+    <dependency ref="packageurl-python==0.13.1"/>
+    <dependency ref="pkgutil_resolve_name==1.3.10"/>
+    <dependency ref="py-serializable==0.16.0">
+      <dependency ref="defusedxml==0.7.1"/>
+    </dependency>
+    <dependency ref="python-dateutil==2.8.2">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="referencing==0.32.0">
+      <dependency ref="attrs==23.1.0"/>
+      <dependency ref="rpds-py==0.15.2"/>
+    </dependency>
+    <dependency ref="rfc3339-validator==0.1.4">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="rfc3987==1.3.8"/>
+    <dependency ref="root-component"/>
+    <dependency ref="rpds-py==0.15.2"/>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="sortedcontainers==2.4.0"/>
+    <dependency ref="types-python-dateutil==2.8.19.14"/>
+    <dependency ref="uri-template==1.3.0"/>
+    <dependency ref="webcolors==1.13"/>
+    <dependency ref="zipp==3.17.0"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.0.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.0.xml.bin
new file mode 100644
index 00000000..a260ce47
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.0.xml.bin
@@ -0,0 +1,26 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>packaging</name>
+      <version>23.2</version>
+      <description>Core utilities for Python packages</description>
+      <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <modified>false</modified>
+    </component>
+    <component type="library">
+      <name>urllib3</name>
+      <version>1.26.8</version>
+      <description>HTTP library with thread-safe connection pooling, file post, and more.</description>
+      <purl>pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
new file mode 100644
index 00000000..0aed7947
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
@@ -0,0 +1,79 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="packaging==23.2">
+      <name>packaging</name>
+      <version>23.2</version>
+      <description>Core utilities for Python packages</description>
+      <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
+        <reference type="documentation">
+          <url>https://packaging.pypa.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/pypa/packaging</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3==1.26.8">
+      <name>urllib3</name>
+      <version>1.26.8</version>
+      <description>HTTP library with thread-safe connection pooling, file post, and more.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+        <reference type="documentation">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/urllib3/urllib3/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/urllib3/urllib3</url>
+          <comment>Project-URL: Code</comment>
+        </reference>
+        <reference type="website">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
new file mode 100644
index 00000000..02fd1c28
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
@@ -0,0 +1,140 @@
+{
+  "components": [
+    {
+      "bom-ref": "packaging==23.2",
+      "description": "Core utilities for Python packages",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "distribution",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://packaging.pypa.io/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/pypa/packaging"
+        }
+      ],
+      "name": "packaging",
+      "purl": "pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176",
+      "type": "library",
+      "version": "23.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "urllib3==1.26.8",
+      "description": "HTTP library with thread-safe connection pooling, file post, and more.",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://urllib3.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/urllib3/urllib3/issues"
+        },
+        {
+          "comment": "Project-URL: Code",
+          "type": "other",
+          "url": "https://github.com/urllib3/urllib3"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://urllib3.readthedocs.io/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": "1.26.8"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "packaging==23.2"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "urllib3==1.26.8"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
new file mode 100644
index 00000000..52c79431
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="packaging==23.2">
+      <name>packaging</name>
+      <version>23.2</version>
+      <description>Core utilities for Python packages</description>
+      <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
+        <reference type="documentation">
+          <url>https://packaging.pypa.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/pypa/packaging</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3==1.26.8">
+      <name>urllib3</name>
+      <version>1.26.8</version>
+      <description>HTTP library with thread-safe connection pooling, file post, and more.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>PackageSource: Archive</comment>
+        </reference>
+        <reference type="documentation">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/urllib3/urllib3/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/urllib3/urllib3</url>
+          <comment>Project-URL: Code</comment>
+        </reference>
+        <reference type="website">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="packaging==23.2"/>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="urllib3==1.26.8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
new file mode 100644
index 00000000..aa6326bd
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
@@ -0,0 +1,152 @@
+{
+  "components": [
+    {
+      "bom-ref": "packaging==23.2",
+      "description": "Core utilities for Python packages",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "distribution",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://packaging.pypa.io/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/pypa/packaging"
+        }
+      ],
+      "name": "packaging",
+      "purl": "pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176",
+      "type": "library",
+      "version": "23.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "urllib3==1.26.8",
+      "description": "HTTP library with thread-safe connection pooling, file post, and more.",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://urllib3.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/urllib3/urllib3/issues"
+        },
+        {
+          "comment": "Project-URL: Code",
+          "type": "other",
+          "url": "https://github.com/urllib3/urllib3"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://urllib3.readthedocs.io/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": "1.26.8"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "packaging==23.2"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "urllib3==1.26.8"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
new file mode 100644
index 00000000..53f1392c
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
@@ -0,0 +1,112 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="packaging==23.2">
+      <name>packaging</name>
+      <version>23.2</version>
+      <description>Core utilities for Python packages</description>
+      <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
+        <reference type="documentation">
+          <url>https://packaging.pypa.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/pypa/packaging</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3==1.26.8">
+      <name>urllib3</name>
+      <version>1.26.8</version>
+      <description>HTTP library with thread-safe connection pooling, file post, and more.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
+          </hashes>
+        </reference>
+        <reference type="documentation">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/urllib3/urllib3/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/urllib3/urllib3</url>
+          <comment>Project-URL: Code</comment>
+        </reference>
+        <reference type="website">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="packaging==23.2"/>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="urllib3==1.26.8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
new file mode 100644
index 00000000..991dfad2
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
@@ -0,0 +1,148 @@
+{
+  "components": [
+    {
+      "bom-ref": "packaging==23.2",
+      "description": "Core utilities for Python packages",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "distribution",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://packaging.pypa.io/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/pypa/packaging"
+        }
+      ],
+      "name": "packaging",
+      "purl": "pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176",
+      "type": "library",
+      "version": "23.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "urllib3==1.26.8",
+      "description": "HTTP library with thread-safe connection pooling, file post, and more.",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://urllib3.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/urllib3/urllib3/issues"
+        },
+        {
+          "comment": "Project-URL: Code",
+          "type": "other",
+          "url": "https://github.com/urllib3/urllib3"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://urllib3.readthedocs.io/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": "1.26.8"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "packaging==23.2"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "urllib3==1.26.8"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
new file mode 100644
index 00000000..a79d3e4f
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
@@ -0,0 +1,139 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="packaging==23.2">
+      <name>packaging</name>
+      <version>23.2</version>
+      <description>Core utilities for Python packages</description>
+      <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
+        <reference type="documentation">
+          <url>https://packaging.pypa.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/pypa/packaging</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3==1.26.8">
+      <name>urllib3</name>
+      <version>1.26.8</version>
+      <description>HTTP library with thread-safe connection pooling, file post, and more.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
+          </hashes>
+        </reference>
+        <reference type="documentation">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/urllib3/urllib3/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/urllib3/urllib3</url>
+          <comment>Project-URL: Code</comment>
+        </reference>
+        <reference type="website">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="packaging==23.2"/>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="urllib3==1.26.8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
new file mode 100644
index 00000000..e2d80154
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
@@ -0,0 +1,148 @@
+{
+  "components": [
+    {
+      "bom-ref": "packaging==23.2",
+      "description": "Core utilities for Python packages",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "distribution",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://packaging.pypa.io/"
+        },
+        {
+          "comment": "Project-URL: Source",
+          "type": "other",
+          "url": "https://github.com/pypa/packaging"
+        }
+      ],
+      "name": "packaging",
+      "purl": "pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176",
+      "type": "library",
+      "version": "23.2"
+    },
+    {
+      "bom-ref": "six==1.16.0",
+      "description": "Python 2 and 3 compatibility utilities",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://github.com/benjaminp/six"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "six",
+      "purl": "pkg:pypi/six@1.16.0",
+      "type": "library",
+      "version": "1.16.0"
+    },
+    {
+      "bom-ref": "urllib3==1.26.8",
+      "description": "HTTP library with thread-safe connection pooling, file post, and more.",
+      "externalReferences": [
+        {
+          "comment": "PackageSource: Archive",
+          "hashes": [
+            {
+              "alg": "SHA-256",
+              "content": "335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977"
+            }
+          ],
+          "type": "distribution",
+          "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
+        },
+        {
+          "comment": "Project-URL: Documentation",
+          "type": "documentation",
+          "url": "https://urllib3.readthedocs.io/"
+        },
+        {
+          "comment": "Project-URL: Issue tracker",
+          "type": "issue-tracker",
+          "url": "https://github.com/urllib3/urllib3/issues"
+        },
+        {
+          "comment": "Project-URL: Code",
+          "type": "other",
+          "url": "https://github.com/urllib3/urllib3"
+        },
+        {
+          "comment": "Home-page",
+          "type": "website",
+          "url": "https://urllib3.readthedocs.io/"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "urllib3",
+      "purl": "pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip",
+      "type": "library",
+      "version": "1.26.8"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "packaging==23.2"
+    },
+    {
+      "dependsOn": [
+        "six==1.16.0"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "six==1.16.0"
+    },
+    {
+      "ref": "urllib3==1.26.8"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages from direct urls",
+      "name": "with-urls",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
new file mode 100644
index 00000000..907d163c
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
@@ -0,0 +1,139 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>with-urls</name>
+      <version>0.1.0</version>
+      <description>packages from direct urls</description>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="packaging==23.2">
+      <name>packaging</name>
+      <version>23.2</version>
+      <description>Core utilities for Python packages</description>
+      <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
+        <reference type="documentation">
+          <url>https://packaging.pypa.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/pypa/packaging</url>
+          <comment>Project-URL: Source</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="six==1.16.0">
+      <name>six</name>
+      <version>1.16.0</version>
+      <description>Python 2 and 3 compatibility utilities</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/six@1.16.0</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254</hash>
+          </hashes>
+        </reference>
+        <reference type="website">
+          <url>https://github.com/benjaminp/six</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <component type="library" bom-ref="urllib3==1.26.8">
+      <name>urllib3</name>
+      <version>1.26.8</version>
+      <description>HTTP library with thread-safe connection pooling, file post, and more.</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/urllib3@1.26.8?download_url=https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</purl>
+      <externalReferences>
+        <reference type="distribution">
+          <url>https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip</url>
+          <comment>PackageSource: Archive</comment>
+          <hashes>
+            <hash alg="SHA-256">335f26daa3f99cae180f477efaf8c45ccaab380e02fe54292e9b5e14b3b41977</hash>
+          </hashes>
+        </reference>
+        <reference type="documentation">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Project-URL: Documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://github.com/urllib3/urllib3/issues</url>
+          <comment>Project-URL: Issue tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://github.com/urllib3/urllib3</url>
+          <comment>Project-URL: Code</comment>
+        </reference>
+        <reference type="website">
+          <url>https://urllib3.readthedocs.io/</url>
+          <comment>Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="packaging==23.2"/>
+    <dependency ref="root-component">
+      <dependency ref="six==1.16.0"/>
+    </dependency>
+    <dependency ref="six==1.16.0"/>
+    <dependency ref="urllib3==1.26.8"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
index 500bb907..7a801fe0 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
@@ -16,19 +16,19 @@
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package urls: Bug Tracker",
+          "comment": "package url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package urls: Change log",
+          "comment": "package url: Funding",
           "type": "other",
-          "url": "https://oss.acme.org/my-project/changelog/"
+          "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package urls: Funding",
+          "comment": "package url: Change log",
           "type": "other",
-          "url": "https://oss.acme.org/my-project/funding/"
+          "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
           "comment": "project metadata: repository",
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
index 299c55a3..ddcc52c2 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
@@ -28,15 +28,15 @@
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package urls: Bug Tracker</comment>
+          <comment>package url: Bug Tracker</comment>
         </reference>
         <reference type="other">
-          <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package urls: Change log</comment>
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>package url: Funding</comment>
         </reference>
         <reference type="other">
-          <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package urls: Funding</comment>
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
index dd9dbc77..76cf3cdb 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
@@ -16,19 +16,19 @@
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package urls: Bug Tracker",
+          "comment": "package url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package urls: Change log",
+          "comment": "package url: Funding",
           "type": "other",
-          "url": "https://oss.acme.org/my-project/changelog/"
+          "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package urls: Funding",
+          "comment": "package url: Change log",
           "type": "other",
-          "url": "https://oss.acme.org/my-project/funding/"
+          "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
           "comment": "project metadata: repository",
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
index 1e6140a2..d437722a 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
@@ -28,15 +28,15 @@
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package urls: Bug Tracker</comment>
+          <comment>package url: Bug Tracker</comment>
         </reference>
         <reference type="other">
-          <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package urls: Change log</comment>
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>package url: Funding</comment>
         </reference>
         <reference type="other">
-          <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package urls: Funding</comment>
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
index 88cf4534..0ce8883f 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
@@ -16,19 +16,19 @@
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package urls: Bug Tracker",
+          "comment": "package url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package urls: Change log",
+          "comment": "package url: Funding",
           "type": "other",
-          "url": "https://oss.acme.org/my-project/changelog/"
+          "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package urls: Funding",
-          "type": "other",
-          "url": "https://oss.acme.org/my-project/funding/"
+          "comment": "package url: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
           "comment": "project metadata: repository",
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
index 5f60a84a..6539cf43 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
@@ -55,15 +55,15 @@
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package urls: Bug Tracker</comment>
-        </reference>
-        <reference type="other">
-          <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package urls: Change log</comment>
+          <comment>package url: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package urls: Funding</comment>
+          <comment>package url: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
index fec3326d..4de17edb 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
@@ -16,19 +16,19 @@
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package urls: Bug Tracker",
+          "comment": "package url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package urls: Change log",
+          "comment": "package url: Funding",
           "type": "other",
-          "url": "https://oss.acme.org/my-project/changelog/"
+          "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package urls: Funding",
-          "type": "other",
-          "url": "https://oss.acme.org/my-project/funding/"
+          "comment": "package url: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
           "comment": "project metadata: repository",
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
index 55a74f6a..65222440 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
@@ -55,15 +55,15 @@
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package urls: Bug Tracker</comment>
-        </reference>
-        <reference type="other">
-          <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package urls: Change log</comment>
+          <comment>package url: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package urls: Funding</comment>
+          <comment>package url: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>package url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
diff --git a/tests/integration/test_cli_environment.py b/tests/integration/test_cli_environment.py
new file mode 100644
index 00000000..a25e716d
--- /dev/null
+++ b/tests/integration/test_cli_environment.py
@@ -0,0 +1,194 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+import random
+from contextlib import redirect_stderr, redirect_stdout
+from glob import glob
+from io import StringIO
+from os import name as os_name
+from os.path import basename, dirname, join
+from subprocess import run  # nosec:B404
+from sys import executable
+from typing import Any, Generator
+from unittest import TestCase, skipIf
+
+from cyclonedx.schema import OutputFormat, SchemaVersion
+from ddt import ddt, named_data
+
+from cyclonedx_py._internal.cli import run as run_cli
+from tests import INFILES_DIRECTORY, INIT_TESTBEDS, SUPPORTED_OF_SV, SnapshotMixin, make_comparable
+
+initfiles = glob(join(INFILES_DIRECTORY, 'environment', '*', 'init.py'))
+projectdirs = list(dirname(initfile) for initfile in initfiles)
+
+test_data = tuple(
+    (f'{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
+    for projectdir in projectdirs
+    for of, sv in SUPPORTED_OF_SV
+)
+
+
+def test_data_file_filter(s: str) -> Generator[Any, None, None]:
+    return ((n, d, sv, of) for n, d, sv, of in test_data if s in n)
+
+
+@ddt
+class TestCliEnvironment(TestCase, SnapshotMixin):
+
+    @classmethod
+    def setUpClass(cls) -> None:
+        if INIT_TESTBEDS:
+            for initfile in initfiles:
+                res = run([executable, initfile],
+                          capture_output=True, encoding='utf8', shell=False)  # nosec:B603
+                if res.returncode != 0:
+                    raise RuntimeError(f'failed init :\n'
+                                       f'stdout: {res.stdout}\n'
+                                       f'stderr: {res.stderr}\n')
+
+    @named_data(
+        ('does-not-exist', 'something-that-must-not-exist.testing', 'No such file or directory'),
+        ('no-env', join(INFILES_DIRECTORY, 'environment', 'broken-env'), 'Failed to find python in directory'),
+    )
+    def test_fails_with_python_not_found(self, wrong_python: str, expected_error: str) -> None:
+        _, _, sv, of = random.choice(test_data)  # nosec B311
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'environment',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    wrong_python])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn(expected_error, err)
+
+    @named_data(
+        ('exit-non-zero', join(INFILES_DIRECTORY, 'environment', 'broken-env', 'non-zero.py'), 'Fail fetching `path`'),
+        ('no-json', join(INFILES_DIRECTORY, 'environment', 'broken-env', 'broken-json.py'), 'JSONDecodeError'),
+    )
+    @skipIf(os_name == 'nt', 'cannot run on win')
+    def test_fails_with_python_unexpected(self, wrong_python: str, expected_error: str) -> None:
+        _, _, sv, of = random.choice(test_data)  # nosec B311
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'environment',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    wrong_python])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn(expected_error, err)
+
+    def test_with_pyproject_not_found(self) -> None:
+        _, projectdir, sv, of = random.choice(test_data)  # nosec B311
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'environment',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    '--pyproject=something-that-must-not-exist.testing',
+                    projectdir
+                ])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertNotEqual(0, res, err)
+        self.assertIn('Could not open pyproject file: something-that-must-not-exist.testing', err)
+
+    def test_with_current_python(self) -> None:
+        sv = SchemaVersion.V1_5
+        of = random.choice((OutputFormat.XML, OutputFormat.JSON))  # nosec B311
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'environment',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    # no project dir -> search in current python
+                ])
+                err = err.getvalue()
+                sbom1 = out.getvalue()
+        self.assertEqual(0, res, err)
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'environment',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    executable  # explicitly current python
+                ])
+            err = err.getvalue()
+            sbom2 = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqual(
+            make_comparable(sbom1, of),
+            make_comparable(sbom2, of)
+        )
+
+    @named_data(*test_data)
+    def test_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+        with StringIO() as err, StringIO() as out:
+            err.name = '<fakeerr>'
+            out.name = '<fakeout>'
+            with redirect_stderr(err), redirect_stdout(out):
+                res = run_cli(argv=[
+                    'environment',
+                    '-vvv',
+                    f'--sv={sv.to_version()}',
+                    f'--of={of.name}',
+                    '--outfile=-',
+                    f'--pyproject={join(projectdir, "pyproject.toml")}',
+                    join(projectdir, '.venv')])
+            err = err.getvalue()
+            out = out.getvalue()
+        self.assertEqual(0, res, err)
+        self.assertEqualSnapshot(out, 'venv', projectdir, sv, of)
+
+    def assertEqualSnapshot(self, actual: str,  # noqa:N802
+                            purpose: str,
+                            projectdir: str,
+                            sv: SchemaVersion,
+                            of: OutputFormat
+                            ) -> None:
+        super().assertEqualSnapshot(
+            make_comparable(actual, of),
+            join('environment', f'{purpose}_{basename(projectdir)}_{sv.to_version()}.{of.name.lower()}')
+        )
diff --git a/tests/integration/test_pipenv.py b/tests/integration/test_cli_pipenv.py
similarity index 91%
rename from tests/integration/test_pipenv.py
rename to tests/integration/test_cli_pipenv.py
index 6eea8f14..d792a1cf 100644
--- a/tests/integration/test_pipenv.py
+++ b/tests/integration/test_cli_pipenv.py
@@ -45,9 +45,9 @@ def test_data_file_filter(s: str) -> Generator[Any, None, None]:
 
 
 @ddt
-class TestPipenv(TestCase, SnapshotMixin):
+class TestCliPipenv(TestCase, SnapshotMixin):
 
-    def test_cli_fails_with_dir_not_found(self) -> None:
+    def test_fails_with_dir_not_found(self) -> None:
         _, projectdir, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
@@ -65,7 +65,7 @@ def test_cli_fails_with_dir_not_found(self) -> None:
         self.assertNotEqual(0, res, err)
         self.assertIn('Could not open lock file: something-that-must-not-exist.testing', err)
 
-    def test_cli_with_pyproject_not_found(self) -> None:
+    def test_with_pyproject_not_found(self) -> None:
         _, projectdir, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
@@ -86,7 +86,7 @@ def test_cli_with_pyproject_not_found(self) -> None:
         self.assertIn('Could not open pyproject file: something-that-must-not-exist.testing', err)
 
     @named_data(*test_data)
-    def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -105,7 +105,7 @@ def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of:
         self.assertEqualSnapshot(out, 'file', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('category-deps'))
-    def test_cli_with_categories_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_categories_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -124,7 +124,7 @@ def test_cli_with_categories_as_expected(self, projectdir: str, sv: SchemaVersio
         self.assertEqualSnapshot(out, 'some-categories', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('default-and-dev'))
-    def test_cli_with_dev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_dev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -143,7 +143,7 @@ def test_cli_with_dev_as_expected(self, projectdir: str, sv: SchemaVersion, of:
         self.assertEqualSnapshot(out, 'with-dev', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('private-packages'))
-    def test_cli_with_pypi_mirror_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_pypi_mirror_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
diff --git a/tests/integration/test_poetry.py b/tests/integration/test_cli_poetry.py
similarity index 92%
rename from tests/integration/test_poetry.py
rename to tests/integration/test_cli_poetry.py
index cfe44b5c..c7eddbd7 100644
--- a/tests/integration/test_poetry.py
+++ b/tests/integration/test_cli_poetry.py
@@ -45,9 +45,9 @@ def test_data_file_filter(s: str) -> Generator[Any, None, None]:
 
 
 @ddt
-class TestPoetry(TestCase, SnapshotMixin):
+class TestCliPoetry(TestCase, SnapshotMixin):
 
-    def test_cli_fails_with_dir_not_found(self) -> None:
+    def test_fails_with_dir_not_found(self) -> None:
         _, projectdir, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
@@ -65,7 +65,7 @@ def test_cli_fails_with_dir_not_found(self) -> None:
         self.assertNotEqual(0, res, err)
         self.assertIn('Could not open pyproject file: something-that-must-not-exist.testing', err)
 
-    def test_cli_fails_with_groups_not_found(self) -> None:
+    def test_fails_with_groups_not_found(self) -> None:
         projectdir = random.choice(projectdirs)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
@@ -95,7 +95,7 @@ def test_cli_fails_with_groups_not_found(self) -> None:
                       " 'MNE-without-B' (via without),"
                       " 'MNE-without-C' (via without)", err)
 
-    def test_cli_fails_with_extras_not_found(self) -> None:
+    def test_fails_with_extras_not_found(self) -> None:
         projectdir = random.choice(projectdirs)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
@@ -117,7 +117,7 @@ def test_cli_fails_with_extras_not_found(self) -> None:
                       '] not specified', err)
 
     @named_data(*test_data)
-    def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -135,7 +135,7 @@ def test_cli_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of:
         self.assertEqualSnapshot(out, basename(dirname(projectdir)), projectdir, sv, of)
 
     @named_data(*test_data_file_filter('group-deps'))
-    def test_cli_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -155,7 +155,7 @@ def test_cli_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, o
         self.assertEqualSnapshot(out, 'some-groups', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('group-deps'))
-    def test_cli_only_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_only_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -174,7 +174,7 @@ def test_cli_only_groups_as_expected(self, projectdir: str, sv: SchemaVersion, o
         self.assertEqualSnapshot(out, 'only-groups', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('group-deps'))
-    def test_cli_nodev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_nodev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -193,7 +193,7 @@ def test_cli_nodev_as_expected(self, projectdir: str, sv: SchemaVersion, of: Out
         self.assertEqualSnapshot(out, 'no-dev', projectdir, sv, of)
 
     @named_data(*test_data_file_filter('with-extras'))
-    def test_cli_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
diff --git a/tests/integration/test_requirements.py b/tests/integration/test_cli_requirements.py
similarity index 93%
rename from tests/integration/test_requirements.py
rename to tests/integration/test_cli_requirements.py
index d57f29f0..d6c48211 100644
--- a/tests/integration/test_requirements.py
+++ b/tests/integration/test_cli_requirements.py
@@ -53,9 +53,9 @@ def test_data_os_filter(data: Tuple[Any, str, Any, Any]) -> bool:
 
 
 @ddt
-class TestRequirements(TestCase, SnapshotMixin):
+class TestCliRequirements(TestCase, SnapshotMixin):
 
-    def test_cli_with_file_not_found(self) -> None:
+    def test_with_file_not_found(self) -> None:
         _, infile, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
@@ -73,7 +73,7 @@ def test_cli_with_file_not_found(self) -> None:
         self.assertNotEqual(0, res, err)
         self.assertIn('Could not open requirements file: something-that-must-not-exist.testing', err)
 
-    def test_cli_with_pyproject_not_found(self) -> None:
+    def test_with_pyproject_not_found(self) -> None:
         _, infile, sv, of = random.choice(test_data)  # nosec B311
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
@@ -94,7 +94,7 @@ def test_cli_with_pyproject_not_found(self) -> None:
         self.assertIn('Could not open pyproject file: something-that-must-not-exist.testing', err)
 
     @named_data(*filter(test_data_os_filter, test_data))
-    def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'
@@ -113,7 +113,7 @@ def test_cli_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: Out
         self.assertEqualSnapshot(out, 'file', infile, sv, of)
 
     @named_data(*test_data)
-    def test_cli_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
+    def test_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: OutputFormat) -> None:
         with StringIO() as err, StringIO() as out, open(infile, 'rb') as inp:
             err.name = '<fakeerr>'
             out.name = '<fakeout>'

From 4bfad6af3ca21290a3c71a523364f56659dee8ce Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 22 Dec 2023 20:20:31 +0100
Subject: [PATCH 148/155] Rewrite 4 more properties (#632)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py            | 13 ++++-
 cyclonedx_py/_internal/environment.py         | 24 +++++++-
 cyclonedx_py/_internal/pipenv.py              |  2 +-
 cyclonedx_py/_internal/requirements.py        | 14 ++---
 cyclonedx_py/_internal/utils/pep610.py        | 55 +++++++++++--------
 .../environment/venv_with-urls_1.1.xml.bin    |  8 +--
 .../environment/venv_with-urls_1.2.json.bin   | 10 ++--
 .../environment/venv_with-urls_1.2.xml.bin    |  8 +--
 .../environment/venv_with-urls_1.3.json.bin   | 20 +++++--
 .../environment/venv_with-urls_1.3.xml.bin    | 12 ++--
 .../environment/venv_with-urls_1.4.json.bin   | 20 +++++--
 .../environment/venv_with-urls_1.4.xml.bin    | 12 ++--
 .../environment/venv_with-urls_1.5.json.bin   | 20 +++++--
 .../environment/venv_with-urls_1.5.xml.bin    | 12 ++--
 .../pipenv/file_with-extras_1.3.json.bin      |  6 +-
 .../pipenv/file_with-extras_1.3.xml.bin       |  6 +-
 .../pipenv/file_with-extras_1.4.json.bin      |  6 +-
 .../pipenv/file_with-extras_1.4.xml.bin       |  6 +-
 .../pipenv/file_with-extras_1.5.json.bin      |  6 +-
 .../pipenv/file_with-extras_1.5.xml.bin       |  6 +-
 .../poetry/some-extras_lock10_1.3.json.bin    |  6 +-
 .../poetry/some-extras_lock10_1.3.xml.bin     |  6 +-
 .../poetry/some-extras_lock10_1.4.json.bin    |  6 +-
 .../poetry/some-extras_lock10_1.4.xml.bin     |  6 +-
 .../poetry/some-extras_lock10_1.5.json.bin    |  6 +-
 .../poetry/some-extras_lock10_1.5.xml.bin     |  6 +-
 .../poetry/some-extras_lock11_1.3.json.bin    |  8 +--
 .../poetry/some-extras_lock11_1.3.xml.bin     |  8 +--
 .../poetry/some-extras_lock11_1.4.json.bin    |  8 +--
 .../poetry/some-extras_lock11_1.4.xml.bin     |  8 +--
 .../poetry/some-extras_lock11_1.5.json.bin    |  8 +--
 .../poetry/some-extras_lock11_1.5.xml.bin     |  8 +--
 .../poetry/some-extras_lock20_1.3.json.bin    |  8 +--
 .../poetry/some-extras_lock20_1.3.xml.bin     |  8 +--
 .../poetry/some-extras_lock20_1.4.json.bin    |  8 +--
 .../poetry/some-extras_lock20_1.4.xml.bin     |  8 +--
 .../poetry/some-extras_lock20_1.5.json.bin    |  8 +--
 .../poetry/some-extras_lock20_1.5.xml.bin     |  8 +--
 .../file_with-extras_1.3.json.bin             |  4 +-
 .../requirements/file_with-extras_1.3.xml.bin |  4 +-
 .../file_with-extras_1.4.json.bin             |  4 +-
 .../requirements/file_with-extras_1.4.xml.bin |  4 +-
 .../file_with-extras_1.5.json.bin             |  4 +-
 .../requirements/file_with-extras_1.5.xml.bin |  4 +-
 .../stream_with-extras_1.3.json.bin           |  4 +-
 .../stream_with-extras_1.3.xml.bin            |  4 +-
 .../stream_with-extras_1.4.json.bin           |  4 +-
 .../stream_with-extras_1.4.xml.bin            |  4 +-
 .../stream_with-extras_1.5.json.bin           |  4 +-
 .../stream_with-extras_1.5.xml.bin            |  4 +-
 50 files changed, 261 insertions(+), 185 deletions(-)

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index 5d231707..c243ee2b 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -46,9 +46,18 @@ def __call__(self, **kwargs: Any) -> 'Bom':  # pragma: no cover
 
 
 class PropertyName(Enum):
+    # region general
+    # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx.md
+    Reproducible = 'cdx:reproducible'
+    # region general
+
     # region python
-    # TODO: register -- name might not be final, find better one
-    PackageExtra = 'cdx:python:package:extra'
+    # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/python.md
+    PackageExtra = 'cdx:python:package:required-extra'
+    PackageSourceSubdirectory = 'cdx:python:package:source:subdirectory'
+    PackageSourceVcsRequestedRevision = 'cdx:poetry:package:source:vcs:requested_revision'
+    PackageSourceVcsCommitId = 'cdx:poetry:package:source:vcs:commit_id'
+    PackageSourceLocalEditable = 'cdx:python:package:source:local:editable'
     # endregion python
 
     # region poetry
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 86a7a2c5..9d9c7a82 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -47,12 +47,14 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         p = ArgumentParser(description='Build an SBOM from Python (virtual) environment',
                            **kwargs)
         if os_name == 'nt':
+            # TODO the Windows help-page might need improvement.
             p.epilog = dedent("""\
                Example Usage:
                  • Build an SBOM from current python environment:
                        > %(prog)s
                  • Build an SBOM from a Python (virtual) environment:
                        > %(prog)s "...some\\path\\bin\\python.exe"
+                       > %(prog)s '...some\\path\\.venv\\'
                  • Build an SBOM from specific Python environment:
                        > where.exe python3.9.exe
                        > %(prog)s "%%path to specific python%%"
@@ -61,6 +63,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        > %(prog)s "%%path to conda python%%"
                  • Build an SBOM from Pipenv environment:
                        > pipenv.exe --py
+                       > pipenv.exe --venv
                        > %(prog)s "%%path to pipenv python%%"
                  • Build an SBOM from Poetry environment:
                        > poetry.exe env info  --executable
@@ -73,17 +76,19 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        $ %(prog)s
                  • Build an SBOM from a Python (virtual) environment:
                        $ %(prog)s '...some/path/bin/python'
+                       $ %(prog)s '.../.venv/'
                  • Build an SBOM from specific Python environment:
                        $ %(prog)s "$(which python3.9)"
                  • Build an SBOM from conda Python environment:
                        $ %(prog)s "$(conda run which python)"
                  • Build an SBOM from Pipenv environment:
                        $ %(prog)s "$(pipenv --py)"
+                       $ %(prog)s "$(pipenv --venv)"
                  • Build an SBOM from Poetry environment:
                        $ %(prog)s "$(poetry env info --executable)"
                """)
         p.add_argument('--pyproject',
-                       metavar='pyproject.toml',
+                       metavar='FILE',
                        help="Path to the root component's `pyproject.toml` according to PEP621",
                        dest='pyproject_file',
                        default=None)
@@ -153,9 +158,11 @@ def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]
                          **kwargs: Any) -> None:
         from importlib.metadata import distributions
 
+        from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentType
         from packageurl import PackageURL
 
+        from . import PropertyName
         from .utils.cdx import licenses_fixup
         from .utils.packaging import metadata2extrefs, metadata2licenses
         from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref, packagesource4dist
@@ -179,10 +186,20 @@ def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]
                 # path of dist-package on disc? naaa... a package may have multiple files/folders on disc
             )
             packagesource = packagesource4dist(dist)
-            purl_qs = {}
+            purl_qs = {}  # https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+            purl_subpath = None
             if packagesource is not None:
+                if packagesource.subdirectory:
+                    component.properties.add(Property(name=PropertyName.PackageSourceSubdirectory.value,
+                                                      value=packagesource.subdirectory))
+                    purl_subpath = packagesource.subdirectory
                 if isinstance(packagesource, PackageSourceVcs):
                     purl_qs['vcs_url'] = f'{packagesource.vcs}+{packagesource.url}@{packagesource.commit_id}'
+                    component.properties.add(Property(name=PropertyName.PackageSourceVcsCommitId.value,
+                                                      value=packagesource.commit_id))
+                    if packagesource.requested_revision:
+                        component.properties.add(Property(name=PropertyName.PackageSourceVcsRequestedRevision.value,
+                                                          value=packagesource.requested_revision))
                 elif isinstance(packagesource, PackageSourceArchive):
                     if '://files.pythonhosted.org/' not in packagesource.url:
                         # skip PURL bloat, do not add implicit information
@@ -193,7 +210,8 @@ def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]
                 del packagesource_extref
             if packagesource is None or not packagesource.url.startswith('file://'):
                 # no purl for locals and unpublished packages
-                component.purl = PackageURL('pypi', name=dist_name, version=dist_version, qualifiers=purl_qs)
+                component.purl = PackageURL('pypi', name=dist_name, version=dist_version,
+                                            qualifiers=purl_qs, subpath=purl_subpath)
             del dist_meta, dist_name, dist_version, packagesource, purl_qs
 
             all_components[component.name.lower()] = (
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index d9642d12..9f0e7b01 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -72,7 +72,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        dest='pypi_url',
                        default=getenv('PIPENV_PYPI_MIRROR'))
         p.add_argument('--pyproject',
-                       metavar='pyproject.toml',
+                       metavar='FILE',
                        help="Path to the root component's `pyproject.toml` according to PEP621",
                        dest='pyproject_file',
                        default=None)
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 5d0dcacd..53103791 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -57,14 +57,14 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                              • Merge multiple files and build an SBOM from it:
                                    $ cat requirements/*.txt | %(prog)s -
                              • Build an inventory for all installed packages:
-                                   $ python3 -m pip freeze --all | %(prog)s -
+                                   $ python -m pip freeze --all | %(prog)s -
                              • Build an inventory for all installed packages in a conda environment:
-                                   $ conda run python3 -m pip freeze --all | %(prog)s -
-                             • Build an inventory for installed packages in a virtual environment:
-                                   $ .../venv/bin/python3 -m pip freeze --all --local --require-virtualenv | %(prog)s -
+                                   $ conda run python -m pip freeze --all | %(prog)s -
+                             • Build an inventory for installed packages in a Python (virtual) environment:
+                                   $ .../.venv/bin/python -m pip freeze --all --local --require-virtualenv | %(prog)s -
                              • Build an inventory from an unfrozen manifest:
-                                   $ python3 -m pip install -r dependencies.txt &&\\
-                                     python3 -m pip freeze | %(prog)s -
+                                   $ python -m pip install -r dependencies.txt &&\\
+                                     python -m pip freeze | %(prog)s -
                            """),
                            **kwargs)
         # the args shall mimic the ones from Pip
@@ -84,7 +84,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        dest='extra_index_urls',
                        default=[])
         p.add_argument('--pyproject',
-                       metavar='pyproject.toml',
+                       metavar='FILE',
                        help="Path to the root component's `pyproject.toml` according to PEP621",
                        dest='pyproject_file',
                        default=None)
diff --git a/cyclonedx_py/_internal/utils/pep610.py b/cyclonedx_py/_internal/utils/pep610.py
index e01e06b4..2bd1f352 100644
--- a/cyclonedx_py/_internal/utils/pep610.py
+++ b/cyclonedx_py/_internal/utils/pep610.py
@@ -35,56 +35,61 @@
 
 class PackageSource(ABC):
     @abstractmethod
-    def __init__(self, url: str) -> None:
+    def __init__(self, url: str, subdirectory: Optional[str]) -> None:
         self.url = url
+        self.subdirectory = subdirectory
 
 
 class PackageSourceVcs(PackageSource):
     # see https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#vcs-urls
 
-    def __init__(self, url: str,
+    def __init__(self, url: str, subdirectory: Optional[str],
                  vcs: str, requested_revision: Optional[str], commit_id: str) -> None:
-        super().__init__(url)
+        super().__init__(url, subdirectory)
         self.vcs = vcs
         self.requested_revision = requested_revision
         self.commit_id = commit_id
 
     @classmethod
-    def from_data(cls, url: str, data: Dict[str, Any]) -> 'PackageSourceVcs':
-        return cls(url, data['vcs'], data.get('requested_revision'), data['commit_id'])
+    def from_data(cls, url: str, subdirectory: Optional[str],
+                  info: Dict[str, Any]) -> 'PackageSourceVcs':
+        return cls(url, subdirectory,
+                   info['vcs'], info.get('requested_revision'), info['commit_id'])
 
 
 class PackageSourceArchive(PackageSource):
     # see https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#archive-urls
 
-    def __init__(self, url: str,
+    def __init__(self, url: str, subdirectory: Optional[str],
                  hashes: Optional[Dict[str, str]]) -> None:
-        super().__init__(url)
+        super().__init__(url, subdirectory)
         self.hashes = hashes or {}
 
     @classmethod
-    def from_data(cls, url: str, data: Dict[str, Any]) -> 'PackageSourceArchive':
-        if 'hashes' in data:
-            hashes = data['hashes']
-        elif 'hash' in data:
-            hash_parts = str(data['hash']).split('=', maxsplit=1)
+    def from_data(cls, url: str, subdirectory: Optional[str],
+                  info: Dict[str, Any]) -> 'PackageSourceArchive':
+        if 'hashes' in info:
+            hashes = info['hashes']
+        elif 'hash' in info:
+            hash_parts = str(info['hash']).split('=', maxsplit=1)
             hashes = {hash_parts[0]: hash_parts[1]}
         else:
             hashes = None
-        return cls(url, hashes)
+        return cls(url, subdirectory, hashes)
 
 
 class PackageSourceLocal(PackageSource):
     # see https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#local-directories
 
-    def __init__(self, url: str,
+    def __init__(self, url: str, subdirectory: Optional[str],
                  editable: bool) -> None:
-        super().__init__(url)
+        super().__init__(url, subdirectory)
         self.editable = editable
 
     @classmethod
-    def from_data(cls, url: str, data: Dict[str, Any]) -> 'PackageSourceLocal':
-        return cls(url, data.get('editable', False))
+    def from_data(cls, url: str, subdirectory: Optional[str],
+                  info: Dict[str, Any]) -> 'PackageSourceLocal':
+        return cls(url, subdirectory, info.get('editable', False))
 
 
 def packagesource4dist(dist: 'Distribution') -> Optional[PackageSource]:
@@ -96,26 +101,28 @@ def packagesource4dist(dist: 'Distribution') -> Optional[PackageSource]:
     except JSONDecodeError:  # pragma: no cover
         return None
     url = data['url']
+    subdirectory = data.get('subdirectory')
     if url == '':
         return None
     if 'vcs_info' in data:
-        return PackageSourceVcs.from_data(url, data['vcs_info'])
+        return PackageSourceVcs.from_data(url, subdirectory, data['vcs_info'])
     if 'archive_info' in data:
-        return PackageSourceArchive.from_data(url, data['archive_info'])
+        return PackageSourceArchive.from_data(url, subdirectory, data['archive_info'])
     if 'dir_info' in data:
-        return PackageSourceLocal.from_data(url, data['dir_info'])
+        return PackageSourceLocal.from_data(url, subdirectory, data['dir_info'])
     return None
 
 
 def packagesource2extref(src: PackageSource) -> Optional['ExternalReference']:
     from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
     from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+    sdir = f' (subdirectory {src.subdirectory!r})' if src.subdirectory else ''
     try:
         if isinstance(src, PackageSourceVcs):
             return ExternalReference(
-                type=ExternalReferenceType.DISTRIBUTION,
+                type=ExternalReferenceType.VCS,
                 url=XsUri(f'{src.url}#{src.commit_id}'),
-                comment=f'PackageSource: VCS {src.vcs!r}')
+                comment=f'PackageSource: VCS {src.vcs!r}{sdir}')
         if isinstance(src, PackageSourceArchive):
             hashes = []
             for hashlib_alg, content in src.hashes.items():
@@ -126,12 +133,12 @@ def packagesource2extref(src: PackageSource) -> Optional['ExternalReference']:
             return ExternalReference(
                 type=ExternalReferenceType.DISTRIBUTION,
                 url=XsUri(src.url), hashes=hashes,
-                comment='PackageSource: Archive')
+                comment=f'PackageSource: Archive{sdir}')
         if isinstance(src, PackageSourceLocal):
             return ExternalReference(
                 type=ExternalReferenceType.DISTRIBUTION,
                 url=XsUri(src.url),
-                comment='PackageSource: Local')
+                comment=f'PackageSource: Local{sdir}')
     except InvalidUriException:
         pass
     return None
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
index 0aed7947..277af824 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
@@ -7,10 +7,6 @@
       <description>Core utilities for Python packages</description>
       <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
-          <comment>PackageSource: VCS 'git'</comment>
-        </reference>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
           <comment>Project-URL: Documentation</comment>
@@ -19,6 +15,10 @@
           <url>https://github.com/pypa/packaging</url>
           <comment>Project-URL: Source</comment>
         </reference>
+        <reference type="vcs">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
       </externalReferences>
     </component>
     <component type="library" bom-ref="six==1.16.0">
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
index 02fd1c28..13fdf9c9 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
@@ -4,11 +4,6 @@
       "bom-ref": "packaging==23.2",
       "description": "Core utilities for Python packages",
       "externalReferences": [
-        {
-          "comment": "PackageSource: VCS 'git'",
-          "type": "distribution",
-          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
-        },
         {
           "comment": "Project-URL: Documentation",
           "type": "documentation",
@@ -18,6 +13,11 @@
           "comment": "Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
+        },
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "vcs",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
         }
       ],
       "name": "packaging",
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
index 52c79431..07875404 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
@@ -26,10 +26,6 @@
       <description>Core utilities for Python packages</description>
       <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
-          <comment>PackageSource: VCS 'git'</comment>
-        </reference>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
           <comment>Project-URL: Documentation</comment>
@@ -38,6 +34,10 @@
           <url>https://github.com/pypa/packaging</url>
           <comment>Project-URL: Source</comment>
         </reference>
+        <reference type="vcs">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
       </externalReferences>
     </component>
     <component type="library" bom-ref="six==1.16.0">
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
index aa6326bd..ab5831e1 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
@@ -4,11 +4,6 @@
       "bom-ref": "packaging==23.2",
       "description": "Core utilities for Python packages",
       "externalReferences": [
-        {
-          "comment": "PackageSource: VCS 'git'",
-          "type": "distribution",
-          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
-        },
         {
           "comment": "Project-URL: Documentation",
           "type": "documentation",
@@ -18,9 +13,24 @@
           "comment": "Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
+        },
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "vcs",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
         }
       ],
       "name": "packaging",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:source:vcs:commit_id",
+          "value": "b3a5d7d68991c040615d5345bb55f61de53ba176"
+        },
+        {
+          "name": "cdx:poetry:package:source:vcs:requested_revision",
+          "value": "23.2"
+        }
+      ],
       "purl": "pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176",
       "type": "library",
       "version": "23.2"
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
index 53f1392c..c149459f 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
@@ -26,10 +26,6 @@
       <description>Core utilities for Python packages</description>
       <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
-          <comment>PackageSource: VCS 'git'</comment>
-        </reference>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
           <comment>Project-URL: Documentation</comment>
@@ -38,7 +34,15 @@
           <url>https://github.com/pypa/packaging</url>
           <comment>Project-URL: Source</comment>
         </reference>
+        <reference type="vcs">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:source:vcs:commit_id">b3a5d7d68991c040615d5345bb55f61de53ba176</property>
+        <property name="cdx:poetry:package:source:vcs:requested_revision">23.2</property>
+      </properties>
     </component>
     <component type="library" bom-ref="six==1.16.0">
       <name>six</name>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
index 991dfad2..07a7ddf1 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
@@ -4,11 +4,6 @@
       "bom-ref": "packaging==23.2",
       "description": "Core utilities for Python packages",
       "externalReferences": [
-        {
-          "comment": "PackageSource: VCS 'git'",
-          "type": "distribution",
-          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
-        },
         {
           "comment": "Project-URL: Documentation",
           "type": "documentation",
@@ -18,9 +13,24 @@
           "comment": "Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
+        },
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "vcs",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
         }
       ],
       "name": "packaging",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:source:vcs:commit_id",
+          "value": "b3a5d7d68991c040615d5345bb55f61de53ba176"
+        },
+        {
+          "name": "cdx:poetry:package:source:vcs:requested_revision",
+          "value": "23.2"
+        }
+      ],
       "purl": "pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176",
       "type": "library",
       "version": "23.2"
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
index a79d3e4f..7c31ca82 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
@@ -53,10 +53,6 @@
       <description>Core utilities for Python packages</description>
       <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
-          <comment>PackageSource: VCS 'git'</comment>
-        </reference>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
           <comment>Project-URL: Documentation</comment>
@@ -65,7 +61,15 @@
           <url>https://github.com/pypa/packaging</url>
           <comment>Project-URL: Source</comment>
         </reference>
+        <reference type="vcs">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:source:vcs:commit_id">b3a5d7d68991c040615d5345bb55f61de53ba176</property>
+        <property name="cdx:poetry:package:source:vcs:requested_revision">23.2</property>
+      </properties>
     </component>
     <component type="library" bom-ref="six==1.16.0">
       <name>six</name>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
index e2d80154..cad40fd3 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
@@ -4,11 +4,6 @@
       "bom-ref": "packaging==23.2",
       "description": "Core utilities for Python packages",
       "externalReferences": [
-        {
-          "comment": "PackageSource: VCS 'git'",
-          "type": "distribution",
-          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
-        },
         {
           "comment": "Project-URL: Documentation",
           "type": "documentation",
@@ -18,9 +13,24 @@
           "comment": "Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
+        },
+        {
+          "comment": "PackageSource: VCS 'git'",
+          "type": "vcs",
+          "url": "https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176"
         }
       ],
       "name": "packaging",
+      "properties": [
+        {
+          "name": "cdx:poetry:package:source:vcs:commit_id",
+          "value": "b3a5d7d68991c040615d5345bb55f61de53ba176"
+        },
+        {
+          "name": "cdx:poetry:package:source:vcs:requested_revision",
+          "value": "23.2"
+        }
+      ],
       "purl": "pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176",
       "type": "library",
       "version": "23.2"
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
index 907d163c..0c6a9a75 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
@@ -53,10 +53,6 @@
       <description>Core utilities for Python packages</description>
       <purl>pkg:pypi/packaging@23.2?vcs_url=git%2Bhttps://github.com/pypa/packaging.git%40b3a5d7d68991c040615d5345bb55f61de53ba176</purl>
       <externalReferences>
-        <reference type="distribution">
-          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
-          <comment>PackageSource: VCS 'git'</comment>
-        </reference>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
           <comment>Project-URL: Documentation</comment>
@@ -65,7 +61,15 @@
           <url>https://github.com/pypa/packaging</url>
           <comment>Project-URL: Source</comment>
         </reference>
+        <reference type="vcs">
+          <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
+          <comment>PackageSource: VCS 'git'</comment>
+        </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:poetry:package:source:vcs:commit_id">b3a5d7d68991c040615d5345bb55f61de53ba176</property>
+        <property name="cdx:poetry:package:source:vcs:requested_revision">23.2</property>
+      </properties>
     </component>
     <component type="library" bom-ref="six==1.16.0">
       <name>six</name>
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
index 9a7e72ad..44836581 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
@@ -116,11 +116,11 @@
           "value": "default"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -304,7 +304,7 @@
           "value": "default"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
index 8fb1e950..855f28f9 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
@@ -90,8 +90,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:pipenv:category">default</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml==0.7.1">
@@ -200,7 +200,7 @@
       </externalReferences>
       <properties>
         <property name="cdx:pipenv:category">default</property>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
index d32b1710..02f063e8 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
@@ -116,11 +116,11 @@
           "value": "default"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -304,7 +304,7 @@
           "value": "default"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
index 5265faed..eab607ee 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
@@ -117,8 +117,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:pipenv:category">default</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml==0.7.1">
@@ -227,7 +227,7 @@
       </externalReferences>
       <properties>
         <property name="cdx:pipenv:category">default</property>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
index 1587783b..0333f94b 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
@@ -116,11 +116,11 @@
           "value": "default"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -304,7 +304,7 @@
           "value": "default"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
index adc09229..3dc514a0 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
@@ -117,8 +117,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:pipenv:category">default</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml==0.7.1">
@@ -227,7 +227,7 @@
       </externalReferences>
       <properties>
         <property name="cdx:pipenv:category">default</property>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
index e269048f..39abe83d 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
@@ -25,11 +25,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -163,7 +163,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
index 8e679260..d4c956c8 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
@@ -19,7 +19,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -42,8 +42,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
index 22c3c25e..7c4943dd 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
@@ -25,11 +25,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -163,7 +163,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
index b3d04699..c9333332 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
@@ -46,7 +46,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -69,8 +69,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
index 7cd27829..3e44318f 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
@@ -25,11 +25,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -163,7 +163,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
index 33f4b7fc..12e32276 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
@@ -46,7 +46,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -69,8 +69,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
index cb0319a0..c37f9529 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
@@ -103,11 +103,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -336,7 +336,7 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
@@ -2110,7 +2110,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
index 9821652c..5ade7e85 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
@@ -19,7 +19,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -94,8 +94,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -246,7 +246,7 @@
       <purl>pkg:pypi/jsonschema@4.19.2</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
index ac64968a..886f0baf 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
@@ -103,11 +103,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -336,7 +336,7 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
@@ -2110,7 +2110,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
index a3ab677b..a09b90b7 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
@@ -46,7 +46,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -121,8 +121,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -273,7 +273,7 @@
       <purl>pkg:pypi/jsonschema@4.19.2</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
index 09f7d397..cbdaaac4 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
@@ -103,11 +103,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -336,7 +336,7 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
@@ -2110,7 +2110,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
index 625389e2..85dbdc63 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
@@ -46,7 +46,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -121,8 +121,8 @@
       <purl>pkg:pypi/cyclonedx-python-lib@5.1.1</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -273,7 +273,7 @@
       <purl>pkg:pypi/jsonschema@4.19.2</purl>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
index 0fe2d5c0..37170e79 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
@@ -133,11 +133,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -374,7 +374,7 @@
       "name": "jsonschema",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
@@ -3156,7 +3156,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
index 407e093e..dbf7f1ef 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
@@ -19,7 +19,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -117,8 +117,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -282,7 +282,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
index c709f4a1..7f8decc1 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
@@ -133,11 +133,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -374,7 +374,7 @@
       "name": "jsonschema",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
@@ -3156,7 +3156,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
index 36fdc525..4d94f970 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
@@ -46,7 +46,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -144,8 +144,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -309,7 +309,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
index 925a1403..152269f5 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
@@ -133,11 +133,11 @@
           "value": "main"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
@@ -374,7 +374,7 @@
       "name": "jsonschema",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "format"
         }
       ],
@@ -3156,7 +3156,7 @@
       "name": "with-extras",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "my-extra"
         }
       ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
index 72ac9bf1..75f5407b 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
@@ -46,7 +46,7 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
       <properties>
-        <property name="cdx:python:package:extra">my-extra</property>
+        <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
   </metadata>
@@ -144,8 +144,8 @@
       </externalReferences>
       <properties>
         <property name="cdx:poetry:group">main</property>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
     <component type="library" bom-ref="defusedxml@0.7.1">
@@ -309,7 +309,7 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">format</property>
+        <property name="cdx:python:package:required-extra">format</property>
       </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications@2023.7.1">
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
index 753cbf69..f2be6263 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
@@ -13,11 +13,11 @@
       "name": "cyclonedx-python-lib",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
index b89cd677..187ad4bb 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
@@ -35,8 +35,8 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
index 05c5b4c5..8e4a57d8 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
@@ -13,11 +13,11 @@
       "name": "cyclonedx-python-lib",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
index b38778b9..59846d93 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
@@ -62,8 +62,8 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
index 4402bc17..27aac3e8 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
@@ -13,11 +13,11 @@
       "name": "cyclonedx-python-lib",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
index eb258efb..196acabc 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
@@ -62,8 +62,8 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
index b142eb75..3a10febe 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
@@ -13,11 +13,11 @@
       "name": "cyclonedx-python-lib",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
index e18f53f1..accd61eb 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
@@ -27,8 +27,8 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
index 7114ebcd..5c282291 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
@@ -13,11 +13,11 @@
       "name": "cyclonedx-python-lib",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
index d547e445..b7d9f55c 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
@@ -54,8 +54,8 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
   </components>
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
index c8359c9f..30a51bb8 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
@@ -13,11 +13,11 @@
       "name": "cyclonedx-python-lib",
       "properties": [
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "json-validation"
         },
         {
-          "name": "cdx:python:package:extra",
+          "name": "cdx:python:package:required-extra",
           "value": "xml-validation"
         }
       ],
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
index acde8a62..f049804c 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
@@ -54,8 +54,8 @@
         </reference>
       </externalReferences>
       <properties>
-        <property name="cdx:python:package:extra">json-validation</property>
-        <property name="cdx:python:package:extra">xml-validation</property>
+        <property name="cdx:python:package:required-extra">json-validation</property>
+        <property name="cdx:python:package:required-extra">xml-validation</property>
       </properties>
     </component>
   </components>

From ce3224c8453bbb97318fc803dbcaa50fdaedea37 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 22 Dec 2023 22:23:21 +0100
Subject: [PATCH 149/155] reproducible (#633)

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/__init__.py            |  3 +++
 cyclonedx_py/_internal/cli.py                 | 20 ++++++++++++++++++-
 tests/__init__.py                             |  3 ---
 .../_data/snapshots/cli/purls-normal.json.bin |  8 +++++++-
 .../_data/snapshots/cli/purls-short.json.bin  |  8 +++++++-
 .../venv_editable-self_1.3.json.bin           |  6 ++++++
 .../venv_editable-self_1.3.xml.bin            |  3 +++
 .../venv_editable-self_1.4.json.bin           |  6 ++++++
 .../venv_editable-self_1.4.xml.bin            |  3 +++
 .../venv_editable-self_1.5.json.bin           |  6 ++++++
 .../venv_editable-self_1.5.xml.bin            |  3 +++
 .../environment/venv_local_1.3.json.bin       |  6 ++++++
 .../environment/venv_local_1.3.xml.bin        |  3 +++
 .../environment/venv_local_1.4.json.bin       |  6 ++++++
 .../environment/venv_local_1.4.xml.bin        |  3 +++
 .../environment/venv_local_1.5.json.bin       |  6 ++++++
 .../environment/venv_local_1.5.xml.bin        |  3 +++
 .../environment/venv_no-deps_1.3.json.bin     |  6 ++++++
 .../environment/venv_no-deps_1.3.xml.bin      |  3 +++
 .../environment/venv_no-deps_1.4.json.bin     |  6 ++++++
 .../environment/venv_no-deps_1.4.xml.bin      |  3 +++
 .../environment/venv_no-deps_1.5.json.bin     |  6 ++++++
 .../environment/venv_no-deps_1.5.xml.bin      |  3 +++
 .../environment/venv_with-extras_1.3.json.bin |  6 ++++++
 .../environment/venv_with-extras_1.3.xml.bin  |  3 +++
 .../environment/venv_with-extras_1.4.json.bin |  6 ++++++
 .../environment/venv_with-extras_1.4.xml.bin  |  3 +++
 .../environment/venv_with-extras_1.5.json.bin |  6 ++++++
 .../environment/venv_with-extras_1.5.xml.bin  |  3 +++
 .../environment/venv_with-urls_1.3.json.bin   |  6 ++++++
 .../environment/venv_with-urls_1.3.xml.bin    |  3 +++
 .../environment/venv_with-urls_1.4.json.bin   |  6 ++++++
 .../environment/venv_with-urls_1.4.xml.bin    |  3 +++
 .../environment/venv_with-urls_1.5.json.bin   |  6 ++++++
 .../environment/venv_with-urls_1.5.xml.bin    |  3 +++
 .../pipenv/file_category-deps_1.3.json.bin    |  6 ++++++
 .../pipenv/file_category-deps_1.3.xml.bin     |  3 +++
 .../pipenv/file_category-deps_1.4.json.bin    |  6 ++++++
 .../pipenv/file_category-deps_1.4.xml.bin     |  3 +++
 .../pipenv/file_category-deps_1.5.json.bin    |  6 ++++++
 .../pipenv/file_category-deps_1.5.xml.bin     |  3 +++
 .../pipenv/file_default-and-dev_1.3.json.bin  |  6 ++++++
 .../pipenv/file_default-and-dev_1.3.xml.bin   |  3 +++
 .../pipenv/file_default-and-dev_1.4.json.bin  |  6 ++++++
 .../pipenv/file_default-and-dev_1.4.xml.bin   |  3 +++
 .../pipenv/file_default-and-dev_1.5.json.bin  |  6 ++++++
 .../pipenv/file_default-and-dev_1.5.xml.bin   |  3 +++
 .../pipenv/file_editable-self_1.3.json.bin    |  6 ++++++
 .../pipenv/file_editable-self_1.3.xml.bin     |  3 +++
 .../pipenv/file_editable-self_1.4.json.bin    |  6 ++++++
 .../pipenv/file_editable-self_1.4.xml.bin     |  3 +++
 .../pipenv/file_editable-self_1.5.json.bin    |  6 ++++++
 .../pipenv/file_editable-self_1.5.xml.bin     |  3 +++
 .../snapshots/pipenv/file_local_1.3.json.bin  |  6 ++++++
 .../snapshots/pipenv/file_local_1.3.xml.bin   |  3 +++
 .../snapshots/pipenv/file_local_1.4.json.bin  |  6 ++++++
 .../snapshots/pipenv/file_local_1.4.xml.bin   |  3 +++
 .../snapshots/pipenv/file_local_1.5.json.bin  |  6 ++++++
 .../snapshots/pipenv/file_local_1.5.xml.bin   |  3 +++
 .../pipenv/file_no-deps_1.3.json.bin          |  6 ++++++
 .../snapshots/pipenv/file_no-deps_1.3.xml.bin |  3 +++
 .../pipenv/file_no-deps_1.4.json.bin          |  6 ++++++
 .../snapshots/pipenv/file_no-deps_1.4.xml.bin |  3 +++
 .../pipenv/file_no-deps_1.5.json.bin          |  6 ++++++
 .../snapshots/pipenv/file_no-deps_1.5.xml.bin |  3 +++
 .../pipenv/file_private-packages_1.3.json.bin |  6 ++++++
 .../pipenv/file_private-packages_1.3.xml.bin  |  3 +++
 .../pipenv/file_private-packages_1.4.json.bin |  6 ++++++
 .../pipenv/file_private-packages_1.4.xml.bin  |  3 +++
 .../pipenv/file_private-packages_1.5.json.bin |  6 ++++++
 .../pipenv/file_private-packages_1.5.xml.bin  |  3 +++
 .../pipenv/file_with-extras_1.3.json.bin      |  6 ++++++
 .../pipenv/file_with-extras_1.3.xml.bin       |  3 +++
 .../pipenv/file_with-extras_1.4.json.bin      |  6 ++++++
 .../pipenv/file_with-extras_1.4.xml.bin       |  3 +++
 .../pipenv/file_with-extras_1.5.json.bin      |  6 ++++++
 .../pipenv/file_with-extras_1.5.xml.bin       |  3 +++
 .../pipenv/file_with-urls_1.3.json.bin        |  6 ++++++
 .../pipenv/file_with-urls_1.3.xml.bin         |  3 +++
 .../pipenv/file_with-urls_1.4.json.bin        |  6 ++++++
 .../pipenv/file_with-urls_1.4.xml.bin         |  3 +++
 .../pipenv/file_with-urls_1.5.json.bin        |  6 ++++++
 .../pipenv/file_with-urls_1.5.xml.bin         |  3 +++
 .../pypi-mirror_private-packages_1.3.json.bin |  6 ++++++
 .../pypi-mirror_private-packages_1.3.xml.bin  |  3 +++
 .../pypi-mirror_private-packages_1.4.json.bin |  6 ++++++
 .../pypi-mirror_private-packages_1.4.xml.bin  |  3 +++
 .../pypi-mirror_private-packages_1.5.json.bin |  6 ++++++
 .../pypi-mirror_private-packages_1.5.xml.bin  |  3 +++
 ...some-categories_category-deps_1.3.json.bin |  6 ++++++
 .../some-categories_category-deps_1.3.xml.bin |  3 +++
 ...some-categories_category-deps_1.4.json.bin |  6 ++++++
 .../some-categories_category-deps_1.4.xml.bin |  3 +++
 ...some-categories_category-deps_1.5.json.bin |  6 ++++++
 .../some-categories_category-deps_1.5.xml.bin |  3 +++
 .../with-dev_default-and-dev_1.3.json.bin     |  6 ++++++
 .../with-dev_default-and-dev_1.3.xml.bin      |  3 +++
 .../with-dev_default-and-dev_1.4.json.bin     |  6 ++++++
 .../with-dev_default-and-dev_1.4.xml.bin      |  3 +++
 .../with-dev_default-and-dev_1.5.json.bin     |  6 ++++++
 .../with-dev_default-and-dev_1.5.xml.bin      |  3 +++
 .../poetry/group-deps_lock11_1.3.json.bin     |  6 ++++++
 .../poetry/group-deps_lock11_1.3.xml.bin      |  3 +++
 .../poetry/group-deps_lock11_1.4.json.bin     |  6 ++++++
 .../poetry/group-deps_lock11_1.4.xml.bin      |  3 +++
 .../poetry/group-deps_lock11_1.5.json.bin     |  6 ++++++
 .../poetry/group-deps_lock11_1.5.xml.bin      |  3 +++
 .../poetry/group-deps_lock20_1.3.json.bin     |  6 ++++++
 .../poetry/group-deps_lock20_1.3.xml.bin      |  3 +++
 .../poetry/group-deps_lock20_1.4.json.bin     |  6 ++++++
 .../poetry/group-deps_lock20_1.4.xml.bin      |  3 +++
 .../poetry/group-deps_lock20_1.5.json.bin     |  6 ++++++
 .../poetry/group-deps_lock20_1.5.xml.bin      |  3 +++
 .../poetry/local_lock10_1.3.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock10_1.3.xml.bin |  3 +++
 .../poetry/local_lock10_1.4.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock10_1.4.xml.bin |  3 +++
 .../poetry/local_lock10_1.5.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock10_1.5.xml.bin |  3 +++
 .../poetry/local_lock11_1.3.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock11_1.3.xml.bin |  3 +++
 .../poetry/local_lock11_1.4.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock11_1.4.xml.bin |  3 +++
 .../poetry/local_lock11_1.5.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock11_1.5.xml.bin |  3 +++
 .../poetry/local_lock20_1.3.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock20_1.3.xml.bin |  3 +++
 .../poetry/local_lock20_1.4.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock20_1.4.xml.bin |  3 +++
 .../poetry/local_lock20_1.5.json.bin          |  6 ++++++
 .../snapshots/poetry/local_lock20_1.5.xml.bin |  3 +++
 .../poetry/main-and-dev_lock10_1.3.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock10_1.3.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock10_1.4.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock10_1.4.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock10_1.5.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock10_1.5.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock11_1.3.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock11_1.3.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock11_1.4.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock11_1.4.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock11_1.5.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock11_1.5.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock20_1.3.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock20_1.3.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock20_1.4.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock20_1.4.xml.bin    |  3 +++
 .../poetry/main-and-dev_lock20_1.5.json.bin   |  6 ++++++
 .../poetry/main-and-dev_lock20_1.5.xml.bin    |  3 +++
 .../poetry/no-deps_lock20_1.3.json.bin        |  6 ++++++
 .../poetry/no-deps_lock20_1.3.xml.bin         |  3 +++
 .../poetry/no-deps_lock20_1.4.json.bin        |  6 ++++++
 .../poetry/no-deps_lock20_1.4.xml.bin         |  3 +++
 .../poetry/no-deps_lock20_1.5.json.bin        |  6 ++++++
 .../poetry/no-deps_lock20_1.5.xml.bin         |  3 +++
 .../poetry/no-dev_lock11_1.3.json.bin         |  6 ++++++
 .../poetry/no-dev_lock11_1.3.xml.bin          |  3 +++
 .../poetry/no-dev_lock11_1.4.json.bin         |  6 ++++++
 .../poetry/no-dev_lock11_1.4.xml.bin          |  3 +++
 .../poetry/no-dev_lock11_1.5.json.bin         |  6 ++++++
 .../poetry/no-dev_lock11_1.5.xml.bin          |  3 +++
 .../poetry/no-dev_lock20_1.3.json.bin         |  6 ++++++
 .../poetry/no-dev_lock20_1.3.xml.bin          |  3 +++
 .../poetry/no-dev_lock20_1.4.json.bin         |  6 ++++++
 .../poetry/no-dev_lock20_1.4.xml.bin          |  3 +++
 .../poetry/no-dev_lock20_1.5.json.bin         |  6 ++++++
 .../poetry/no-dev_lock20_1.5.xml.bin          |  3 +++
 .../poetry/only-groups_lock11_1.3.json.bin    |  6 ++++++
 .../poetry/only-groups_lock11_1.3.xml.bin     |  3 +++
 .../poetry/only-groups_lock11_1.4.json.bin    |  6 ++++++
 .../poetry/only-groups_lock11_1.4.xml.bin     |  3 +++
 .../poetry/only-groups_lock11_1.5.json.bin    |  6 ++++++
 .../poetry/only-groups_lock11_1.5.xml.bin     |  3 +++
 .../poetry/only-groups_lock20_1.3.json.bin    |  6 ++++++
 .../poetry/only-groups_lock20_1.3.xml.bin     |  3 +++
 .../poetry/only-groups_lock20_1.4.json.bin    |  6 ++++++
 .../poetry/only-groups_lock20_1.4.xml.bin     |  3 +++
 .../poetry/only-groups_lock20_1.5.json.bin    |  6 ++++++
 .../poetry/only-groups_lock20_1.5.xml.bin     |  3 +++
 .../private-packges_lock10_1.3.json.bin       |  6 ++++++
 .../poetry/private-packges_lock10_1.3.xml.bin |  3 +++
 .../private-packges_lock10_1.4.json.bin       |  6 ++++++
 .../poetry/private-packges_lock10_1.4.xml.bin |  3 +++
 .../private-packges_lock10_1.5.json.bin       |  6 ++++++
 .../poetry/private-packges_lock10_1.5.xml.bin |  3 +++
 .../private-packges_lock11_1.3.json.bin       |  6 ++++++
 .../poetry/private-packges_lock11_1.3.xml.bin |  3 +++
 .../private-packges_lock11_1.4.json.bin       |  6 ++++++
 .../poetry/private-packges_lock11_1.4.xml.bin |  3 +++
 .../private-packges_lock11_1.5.json.bin       |  6 ++++++
 .../poetry/private-packges_lock11_1.5.xml.bin |  3 +++
 .../private-packges_lock20_1.3.json.bin       |  6 ++++++
 .../poetry/private-packges_lock20_1.3.xml.bin |  3 +++
 .../private-packges_lock20_1.4.json.bin       |  6 ++++++
 .../poetry/private-packges_lock20_1.4.xml.bin |  3 +++
 .../private-packges_lock20_1.5.json.bin       |  6 ++++++
 .../poetry/private-packges_lock20_1.5.xml.bin |  3 +++
 .../regression-issue611_lock20_1.3.json.bin   |  6 ++++++
 .../regression-issue611_lock20_1.3.xml.bin    |  3 +++
 .../regression-issue611_lock20_1.4.json.bin   |  6 ++++++
 .../regression-issue611_lock20_1.4.xml.bin    |  3 +++
 .../regression-issue611_lock20_1.5.json.bin   |  6 ++++++
 .../regression-issue611_lock20_1.5.xml.bin    |  3 +++
 .../poetry/some-extras_lock10_1.3.json.bin    |  6 ++++++
 .../poetry/some-extras_lock10_1.3.xml.bin     |  3 +++
 .../poetry/some-extras_lock10_1.4.json.bin    |  6 ++++++
 .../poetry/some-extras_lock10_1.4.xml.bin     |  3 +++
 .../poetry/some-extras_lock10_1.5.json.bin    |  6 ++++++
 .../poetry/some-extras_lock10_1.5.xml.bin     |  3 +++
 .../poetry/some-extras_lock11_1.3.json.bin    |  6 ++++++
 .../poetry/some-extras_lock11_1.3.xml.bin     |  3 +++
 .../poetry/some-extras_lock11_1.4.json.bin    |  6 ++++++
 .../poetry/some-extras_lock11_1.4.xml.bin     |  3 +++
 .../poetry/some-extras_lock11_1.5.json.bin    |  6 ++++++
 .../poetry/some-extras_lock11_1.5.xml.bin     |  3 +++
 .../poetry/some-extras_lock20_1.3.json.bin    |  6 ++++++
 .../poetry/some-extras_lock20_1.3.xml.bin     |  3 +++
 .../poetry/some-extras_lock20_1.4.json.bin    |  6 ++++++
 .../poetry/some-extras_lock20_1.4.xml.bin     |  3 +++
 .../poetry/some-extras_lock20_1.5.json.bin    |  6 ++++++
 .../poetry/some-extras_lock20_1.5.xml.bin     |  3 +++
 .../poetry/some-groups_lock11_1.3.json.bin    |  6 ++++++
 .../poetry/some-groups_lock11_1.3.xml.bin     |  3 +++
 .../poetry/some-groups_lock11_1.4.json.bin    |  6 ++++++
 .../poetry/some-groups_lock11_1.4.xml.bin     |  3 +++
 .../poetry/some-groups_lock11_1.5.json.bin    |  6 ++++++
 .../poetry/some-groups_lock11_1.5.xml.bin     |  3 +++
 .../poetry/some-groups_lock20_1.3.json.bin    |  6 ++++++
 .../poetry/some-groups_lock20_1.3.xml.bin     |  3 +++
 .../poetry/some-groups_lock20_1.4.json.bin    |  6 ++++++
 .../poetry/some-groups_lock20_1.4.xml.bin     |  3 +++
 .../poetry/some-groups_lock20_1.5.json.bin    |  6 ++++++
 .../poetry/some-groups_lock20_1.5.xml.bin     |  3 +++
 .../poetry/with-extras_lock10_1.3.json.bin    |  6 ++++++
 .../poetry/with-extras_lock10_1.3.xml.bin     |  3 +++
 .../poetry/with-extras_lock10_1.4.json.bin    |  6 ++++++
 .../poetry/with-extras_lock10_1.4.xml.bin     |  3 +++
 .../poetry/with-extras_lock10_1.5.json.bin    |  6 ++++++
 .../poetry/with-extras_lock10_1.5.xml.bin     |  3 +++
 .../poetry/with-extras_lock11_1.3.json.bin    |  6 ++++++
 .../poetry/with-extras_lock11_1.3.xml.bin     |  3 +++
 .../poetry/with-extras_lock11_1.4.json.bin    |  6 ++++++
 .../poetry/with-extras_lock11_1.4.xml.bin     |  3 +++
 .../poetry/with-extras_lock11_1.5.json.bin    |  6 ++++++
 .../poetry/with-extras_lock11_1.5.xml.bin     |  3 +++
 .../poetry/with-extras_lock20_1.3.json.bin    |  6 ++++++
 .../poetry/with-extras_lock20_1.3.xml.bin     |  3 +++
 .../poetry/with-extras_lock20_1.4.json.bin    |  6 ++++++
 .../poetry/with-extras_lock20_1.4.xml.bin     |  3 +++
 .../poetry/with-extras_lock20_1.5.json.bin    |  6 ++++++
 .../poetry/with-extras_lock20_1.5.xml.bin     |  3 +++
 .../poetry/with-urls_lock10_1.3.json.bin      |  6 ++++++
 .../poetry/with-urls_lock10_1.3.xml.bin       |  3 +++
 .../poetry/with-urls_lock10_1.4.json.bin      |  6 ++++++
 .../poetry/with-urls_lock10_1.4.xml.bin       |  3 +++
 .../poetry/with-urls_lock10_1.5.json.bin      |  6 ++++++
 .../poetry/with-urls_lock10_1.5.xml.bin       |  3 +++
 .../poetry/with-urls_lock11_1.3.json.bin      |  6 ++++++
 .../poetry/with-urls_lock11_1.3.xml.bin       |  3 +++
 .../poetry/with-urls_lock11_1.4.json.bin      |  6 ++++++
 .../poetry/with-urls_lock11_1.4.xml.bin       |  3 +++
 .../poetry/with-urls_lock11_1.5.json.bin      |  6 ++++++
 .../poetry/with-urls_lock11_1.5.xml.bin       |  3 +++
 .../poetry/with-urls_lock20_1.3.json.bin      |  6 ++++++
 .../poetry/with-urls_lock20_1.3.xml.bin       |  3 +++
 .../poetry/with-urls_lock20_1.4.json.bin      |  6 ++++++
 .../poetry/with-urls_lock20_1.4.xml.bin       |  3 +++
 .../poetry/with-urls_lock20_1.5.json.bin      |  6 ++++++
 .../poetry/with-urls_lock20_1.5.xml.bin       |  3 +++
 .../requirements/file_frozen_1.3.json.bin     |  6 ++++++
 .../requirements/file_frozen_1.3.xml.bin      |  3 +++
 .../requirements/file_frozen_1.4.json.bin     |  6 ++++++
 .../requirements/file_frozen_1.4.xml.bin      |  3 +++
 .../requirements/file_frozen_1.5.json.bin     |  6 ++++++
 .../requirements/file_frozen_1.5.xml.bin      |  3 +++
 .../requirements/file_local_1.3.json.bin      |  6 ++++++
 .../requirements/file_local_1.3.xml.bin       |  3 +++
 .../requirements/file_local_1.4.json.bin      |  6 ++++++
 .../requirements/file_local_1.4.xml.bin       |  3 +++
 .../requirements/file_local_1.5.json.bin      |  6 ++++++
 .../requirements/file_local_1.5.xml.bin       |  3 +++
 .../requirements/file_nested_1.3.json.bin     |  6 ++++++
 .../requirements/file_nested_1.3.xml.bin      |  3 +++
 .../requirements/file_nested_1.4.json.bin     |  6 ++++++
 .../requirements/file_nested_1.4.xml.bin      |  3 +++
 .../requirements/file_nested_1.5.json.bin     |  6 ++++++
 .../requirements/file_nested_1.5.xml.bin      |  3 +++
 .../file_private-packages_1.3.json.bin        |  6 ++++++
 .../file_private-packages_1.3.xml.bin         |  3 +++
 .../file_private-packages_1.4.json.bin        |  6 ++++++
 .../file_private-packages_1.4.xml.bin         |  3 +++
 .../file_private-packages_1.5.json.bin        |  6 ++++++
 .../file_private-packages_1.5.xml.bin         |  3 +++
 ...egression-issue448.cp1252.txt_1.3.json.bin |  6 ++++++
 ...regression-issue448.cp1252.txt_1.3.xml.bin |  3 +++
 ...egression-issue448.cp1252.txt_1.4.json.bin |  6 ++++++
 ...regression-issue448.cp1252.txt_1.4.xml.bin |  3 +++
 ...egression-issue448.cp1252.txt_1.5.json.bin |  6 ++++++
 ...regression-issue448.cp1252.txt_1.5.xml.bin |  3 +++
 .../file_with-comments_1.3.json.bin           |  6 ++++++
 .../file_with-comments_1.3.xml.bin            |  3 +++
 .../file_with-comments_1.4.json.bin           |  6 ++++++
 .../file_with-comments_1.4.xml.bin            |  3 +++
 .../file_with-comments_1.5.json.bin           |  6 ++++++
 .../file_with-comments_1.5.xml.bin            |  3 +++
 .../file_with-extras_1.3.json.bin             |  6 ++++++
 .../requirements/file_with-extras_1.3.xml.bin |  3 +++
 .../file_with-extras_1.4.json.bin             |  6 ++++++
 .../requirements/file_with-extras_1.4.xml.bin |  3 +++
 .../file_with-extras_1.5.json.bin             |  6 ++++++
 .../requirements/file_with-extras_1.5.xml.bin |  3 +++
 .../file_with-hashes_1.3.json.bin             |  6 ++++++
 .../requirements/file_with-hashes_1.3.xml.bin |  3 +++
 .../file_with-hashes_1.4.json.bin             |  6 ++++++
 .../requirements/file_with-hashes_1.4.xml.bin |  3 +++
 .../file_with-hashes_1.5.json.bin             |  6 ++++++
 .../requirements/file_with-hashes_1.5.xml.bin |  3 +++
 .../requirements/file_with-urls_1.3.json.bin  |  6 ++++++
 .../requirements/file_with-urls_1.3.xml.bin   |  3 +++
 .../requirements/file_with-urls_1.4.json.bin  |  6 ++++++
 .../requirements/file_with-urls_1.4.xml.bin   |  3 +++
 .../requirements/file_with-urls_1.5.json.bin  |  6 ++++++
 .../requirements/file_with-urls_1.5.xml.bin   |  3 +++
 .../file_without-pinned-versions_1.3.json.bin |  6 ++++++
 .../file_without-pinned-versions_1.3.xml.bin  |  3 +++
 .../file_without-pinned-versions_1.4.json.bin |  6 ++++++
 .../file_without-pinned-versions_1.4.xml.bin  |  3 +++
 .../file_without-pinned-versions_1.5.json.bin |  6 ++++++
 .../file_without-pinned-versions_1.5.xml.bin  |  3 +++
 .../requirements/stream_frozen_1.3.json.bin   |  6 ++++++
 .../requirements/stream_frozen_1.3.xml.bin    |  3 +++
 .../requirements/stream_frozen_1.4.json.bin   |  6 ++++++
 .../requirements/stream_frozen_1.4.xml.bin    |  3 +++
 .../requirements/stream_frozen_1.5.json.bin   |  6 ++++++
 .../requirements/stream_frozen_1.5.xml.bin    |  3 +++
 .../requirements/stream_local_1.3.json.bin    |  6 ++++++
 .../requirements/stream_local_1.3.xml.bin     |  3 +++
 .../requirements/stream_local_1.4.json.bin    |  6 ++++++
 .../requirements/stream_local_1.4.xml.bin     |  3 +++
 .../requirements/stream_local_1.5.json.bin    |  6 ++++++
 .../requirements/stream_local_1.5.xml.bin     |  3 +++
 .../requirements/stream_nested_1.3.json.bin   |  6 ++++++
 .../requirements/stream_nested_1.3.xml.bin    |  3 +++
 .../requirements/stream_nested_1.4.json.bin   |  6 ++++++
 .../requirements/stream_nested_1.4.xml.bin    |  3 +++
 .../requirements/stream_nested_1.5.json.bin   |  6 ++++++
 .../requirements/stream_nested_1.5.xml.bin    |  3 +++
 .../stream_private-packages_1.3.json.bin      |  6 ++++++
 .../stream_private-packages_1.3.xml.bin       |  3 +++
 .../stream_private-packages_1.4.json.bin      |  6 ++++++
 .../stream_private-packages_1.4.xml.bin       |  3 +++
 .../stream_private-packages_1.5.json.bin      |  6 ++++++
 .../stream_private-packages_1.5.xml.bin       |  3 +++
 ...egression-issue448.cp1252.txt_1.3.json.bin |  6 ++++++
 ...regression-issue448.cp1252.txt_1.3.xml.bin |  3 +++
 ...egression-issue448.cp1252.txt_1.4.json.bin |  6 ++++++
 ...regression-issue448.cp1252.txt_1.4.xml.bin |  3 +++
 ...egression-issue448.cp1252.txt_1.5.json.bin |  6 ++++++
 ...regression-issue448.cp1252.txt_1.5.xml.bin |  3 +++
 .../stream_with-comments_1.3.json.bin         |  6 ++++++
 .../stream_with-comments_1.3.xml.bin          |  3 +++
 .../stream_with-comments_1.4.json.bin         |  6 ++++++
 .../stream_with-comments_1.4.xml.bin          |  3 +++
 .../stream_with-comments_1.5.json.bin         |  6 ++++++
 .../stream_with-comments_1.5.xml.bin          |  3 +++
 .../stream_with-extras_1.3.json.bin           |  6 ++++++
 .../stream_with-extras_1.3.xml.bin            |  3 +++
 .../stream_with-extras_1.4.json.bin           |  6 ++++++
 .../stream_with-extras_1.4.xml.bin            |  3 +++
 .../stream_with-extras_1.5.json.bin           |  6 ++++++
 .../stream_with-extras_1.5.xml.bin            |  3 +++
 .../stream_with-hashes_1.3.json.bin           |  6 ++++++
 .../stream_with-hashes_1.3.xml.bin            |  3 +++
 .../stream_with-hashes_1.4.json.bin           |  6 ++++++
 .../stream_with-hashes_1.4.xml.bin            |  3 +++
 .../stream_with-hashes_1.5.json.bin           |  6 ++++++
 .../stream_with-hashes_1.5.xml.bin            |  3 +++
 .../stream_with-urls_1.3.json.bin             |  6 ++++++
 .../requirements/stream_with-urls_1.3.xml.bin |  3 +++
 .../stream_with-urls_1.4.json.bin             |  6 ++++++
 .../requirements/stream_with-urls_1.4.xml.bin |  3 +++
 .../stream_with-urls_1.5.json.bin             |  6 ++++++
 .../requirements/stream_with-urls_1.5.xml.bin |  3 +++
 ...tream_without-pinned-versions_1.3.json.bin |  6 ++++++
 ...stream_without-pinned-versions_1.3.xml.bin |  3 +++
 ...tream_without-pinned-versions_1.4.json.bin |  6 ++++++
 ...stream_without-pinned-versions_1.4.xml.bin |  3 +++
 ...tream_without-pinned-versions_1.5.json.bin |  6 ++++++
 ...stream_without-pinned-versions_1.5.xml.bin |  3 +++
 tests/integration/test_cli_environment.py     |  3 +++
 tests/integration/test_cli_pipenv.py          |  4 ++++
 tests/integration/test_cli_poetry.py          |  5 +++++
 tests/integration/test_cli_requirements.py    |  2 ++
 tests/unit/test_cli.py                        |  9 ++++++---
 394 files changed, 1784 insertions(+), 9 deletions(-)

diff --git a/cyclonedx_py/_internal/__init__.py b/cyclonedx_py/_internal/__init__.py
index c243ee2b..b76ae1da 100644
--- a/cyclonedx_py/_internal/__init__.py
+++ b/cyclonedx_py/_internal/__init__.py
@@ -48,6 +48,9 @@ def __call__(self, **kwargs: Any) -> 'Bom':  # pragma: no cover
 class PropertyName(Enum):
     # region general
     # see https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx.md
+    BooleanTrue = 'true'
+    BooleanFalse = 'false'
+
     Reproducible = 'cdx:reproducible'
     # region general
 
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index de448cda..cc774861 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -90,6 +90,12 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                         choices=OutputFormat,
                         type=argparse_type4enum(OutputFormat),
                         default=OutputFormat.JSON.name)
+        op.add_argument('--output-reproducible',
+                        help='Whether to go the extra mile and make the output reproducible.\n'
+                             'This might result in loss of time- and random-based-values.',
+                        action='store_true',
+                        dest='output_reproducible',
+                        default=False)
         if BooleanOptionalAction:
             op.add_argument('--validate',
                             help='Whether validate the result before outputting (default: %(default)s)',
@@ -127,7 +133,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
 
         return p
 
-    __OWN_ARGS = {'outfile', 'schema_version', 'output_format', 'validate'}
+    __OWN_ARGS = {'outfile', 'schema_version', 'output_format', 'reproducible', 'validate'}
 
     @classmethod
     def _clean_kwargs(cls, kwargs: Dict[str, Any]) -> Dict[str, Any]:
@@ -138,6 +144,7 @@ def __init__(self, *,
                  short_purls: bool,
                  output_format: OutputFormat,
                  schema_version: SchemaVersion,
+                 output_reproducible: bool,
                  should_validate: bool,
                  _bbc: Type['BomBuilder'],
                  **kwargs: Any) -> None:
@@ -145,6 +152,7 @@ def __init__(self, *,
         self._short_purls = short_purls
         self._output_format = output_format
         self._schema_version = schema_version
+        self._output_reproducible = output_reproducible
         self._should_validate = should_validate
         self._bbc = _bbc(**self._clean_kwargs(kwargs),
                          logger=self._logger.getChild(_bbc.__name__))
@@ -205,8 +213,18 @@ def _write(self, output: str, outfile: TextIO) -> int:
 
     def _make_output(self, bom: 'Bom') -> str:
         self._logger.info('Serializing SBOM: %s/%s', self._schema_version.to_version(), self._output_format.name)
+        from cyclonedx.model import Property
         from cyclonedx.output import make_outputter
 
+        from . import PropertyName
+
+        if self._output_reproducible:
+            bom.metadata.properties.add(Property(name=PropertyName.Reproducible.value,
+                                                 value=PropertyName.BooleanTrue.value))
+            # dirty hacks to remove these mandatory properties
+            bom.serial_number = None  # type:ignore[assignment]
+            bom.metadata.timestamp = None  # type:ignore[assignment]
+
         return make_outputter(
             bom,
             self._output_format,
diff --git a/tests/__init__.py b/tests/__init__.py
index fe0d816a..f9a8a3b5 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -95,8 +95,6 @@ def assertEqualSnapshot(self: Union[TestCase, 'SnapshotMixin'],  # noqa: N802
 def make_xml_comparable(bom: str) -> str:
     bom = bom.replace(_root_file_uri_xml, 'file://.../')
     bom = bom.replace(_root_file_uri_xml_attr, 'file://.../')
-    bom = re.sub(' serialNumber=".+?"', '', bom)
-    bom = re.sub(r'\s*<timestamp>.*?</timestamp>', '', bom)
     bom = bom.replace(  # replace metadata.tools.version
         '        <vendor>CycloneDX</vendor>\n'
         '        <name>cyclonedx-bom</name>\n'
@@ -127,7 +125,6 @@ def make_xml_comparable(bom: str) -> str:
 
 def make_json_comparable(bom: str) -> str:
     bom = bom.replace(_root_file_uri_json, 'file://.../')
-    bom = re.sub(r'\s*"(?:timestamp|serialNumber)": ".+?",?', '', bom)
     bom = bom.replace(  # replace metadata.tools.version
         '        "name": "cyclonedx-bom",\n'
         '        "vendor": "CycloneDX",\n'
diff --git a/tests/_data/snapshots/cli/purls-normal.json.bin b/tests/_data/snapshots/cli/purls-normal.json.bin
index f0ad7d50..2e88d0ba 100644
--- a/tests/_data/snapshots/cli/purls-normal.json.bin
+++ b/tests/_data/snapshots/cli/purls-normal.json.bin
@@ -29,7 +29,13 @@
       "name": "my-app",
       "purl": "pkg:generic/testing/my-app@1",
       "type": "application"
-    }
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ]
   },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
diff --git a/tests/_data/snapshots/cli/purls-short.json.bin b/tests/_data/snapshots/cli/purls-short.json.bin
index 29fa367c..33d7e39f 100644
--- a/tests/_data/snapshots/cli/purls-short.json.bin
+++ b/tests/_data/snapshots/cli/purls-short.json.bin
@@ -29,7 +29,13 @@
       "name": "my-app",
       "purl": "pkg:generic/testing/my-app@1",
       "type": "application"
-    }
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ]
   },
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
index 988e242d..e351e0f6 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
@@ -42,6 +42,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
index de07fa59..74b98501 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>install the current project as an editable</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="six==1.16.0">
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
index e2740f78..bcf8d158 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
@@ -42,6 +42,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
index 7f1c9caa..271da970 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>install the current project as an editable</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="six==1.16.0">
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
index 3887a176..8a80a1fd 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
@@ -42,6 +42,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
index 016d2d59..607ea275 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>install the current project as an editable</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="six==1.16.0">
diff --git a/tests/_data/snapshots/environment/venv_local_1.3.json.bin b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
index bf2d83c1..3e09434a 100644
--- a/tests/_data/snapshots/environment/venv_local_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.3.json.bin
@@ -98,6 +98,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/environment/venv_local_1.3.xml.bin b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
index b2491503..9c663c20 100644
--- a/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a==23.42">
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.json.bin b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
index 0f7ce3f8..e6298492 100644
--- a/tests/_data/snapshots/environment/venv_local_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.4.json.bin
@@ -98,6 +98,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_local_1.4.xml.bin b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
index f63bcb52..c3ad1442 100644
--- a/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a==23.42">
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.json.bin b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
index 9db516ef..948eeb0b 100644
--- a/tests/_data/snapshots/environment/venv_local_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.5.json.bin
@@ -98,6 +98,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_local_1.5.xml.bin b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
index c98ce8fa..13138e0a 100644
--- a/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_local_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a==23.42">
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
index 0e68e583..51944f0f 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
@@ -17,6 +17,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
index bb7c9d9f..6b024c83 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
index c08f4eca..00aae6df 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
@@ -17,6 +17,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
index a6ae68bb..fdc1f9a7 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
index a25741c6..788abb29 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
@@ -17,6 +17,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
index 461db07e..05b343fe 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
index 42bbd250..d1dc3e38 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
@@ -1029,6 +1029,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
index db5aa4d1..52267114 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
index dfcfa12d..7981de21 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
@@ -1029,6 +1029,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
index 17fb8afa..7c3479cd 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
index 3b4c2ede..80e13924 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
@@ -1029,6 +1029,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
index 9e56e5c9..16b60a61 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
index ab5831e1..93afaba8 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
@@ -142,6 +142,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
index c149459f..dc27cd5d 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="packaging==23.2">
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
index 07a7ddf1..b4a20533 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
@@ -142,6 +142,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
index 7c31ca82..277e2add 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="packaging==23.2">
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
index cad40fd3..a4e0d3bc 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
@@ -142,6 +142,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
index 0c6a9a75..0776367a 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="packaging==23.2">
diff --git a/tests/_data/snapshots/pipenv/file_category-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.3.json.bin
index 8f03271c..bf5f1400 100644
--- a/tests/_data/snapshots/pipenv/file_category-deps_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_category-deps_1.3.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_category-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.3.xml.bin
index 2d69fbd9..66ddf3f3 100644
--- a/tests/_data/snapshots/pipenv/file_category-deps_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_category-deps_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml==0.10.2">
diff --git a/tests/_data/snapshots/pipenv/file_category-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.4.json.bin
index d5f82957..4ab1f8f5 100644
--- a/tests/_data/snapshots/pipenv/file_category-deps_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_category-deps_1.4.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_category-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.4.xml.bin
index d94d68c7..f6c5bdc1 100644
--- a/tests/_data/snapshots/pipenv/file_category-deps_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_category-deps_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml==0.10.2">
diff --git a/tests/_data/snapshots/pipenv/file_category-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.5.json.bin
index b9dfb20f..7697d684 100644
--- a/tests/_data/snapshots/pipenv/file_category-deps_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_category-deps_1.5.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_category-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_category-deps_1.5.xml.bin
index 9c800b74..17c7825a 100644
--- a/tests/_data/snapshots/pipenv/file_category-deps_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_category-deps_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml==0.10.2">
diff --git a/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.json.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.json.bin
index 61d5a130..af4a6d9c 100644
--- a/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.json.bin
@@ -80,6 +80,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.xml.bin
index c8e64be6..166d4c3e 100644
--- a/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_default-and-dev_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>default and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama==0.4.6">
diff --git a/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.json.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.json.bin
index 408580c6..3b30cd66 100644
--- a/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.json.bin
@@ -80,6 +80,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.xml.bin
index dedb7066..f236015a 100644
--- a/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_default-and-dev_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>default and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama==0.4.6">
diff --git a/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.json.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.json.bin
index 99ceb363..3cfb9c32 100644
--- a/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.json.bin
@@ -80,6 +80,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.xml.bin
index 869c6151..4195089e 100644
--- a/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_default-and-dev_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>default and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama==0.4.6">
diff --git a/tests/_data/snapshots/pipenv/file_editable-self_1.3.json.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.3.json.bin
index 84b8ac78..ff13d796 100644
--- a/tests/_data/snapshots/pipenv/file_editable-self_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_editable-self_1.3.json.bin
@@ -18,6 +18,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_editable-self_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.3.xml.bin
index d3dac7d0..f549a582 100644
--- a/tests/_data/snapshots/pipenv/file_editable-self_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_editable-self_1.3.xml.bin
@@ -21,6 +21,9 @@
         <property name="cdx:pipenv:category">default</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/pipenv/file_editable-self_1.4.json.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.4.json.bin
index 3d61f138..1bd3f8a4 100644
--- a/tests/_data/snapshots/pipenv/file_editable-self_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_editable-self_1.4.json.bin
@@ -18,6 +18,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_editable-self_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.4.xml.bin
index cca4514a..1b93b263 100644
--- a/tests/_data/snapshots/pipenv/file_editable-self_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_editable-self_1.4.xml.bin
@@ -48,6 +48,9 @@
         <property name="cdx:pipenv:category">default</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/pipenv/file_editable-self_1.5.json.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.5.json.bin
index d582f6bc..b587a645 100644
--- a/tests/_data/snapshots/pipenv/file_editable-self_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_editable-self_1.5.json.bin
@@ -18,6 +18,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_editable-self_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_editable-self_1.5.xml.bin
index ea1d4c82..d10c0937 100644
--- a/tests/_data/snapshots/pipenv/file_editable-self_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_editable-self_1.5.xml.bin
@@ -48,6 +48,9 @@
         <property name="cdx:pipenv:category">default</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/pipenv/file_local_1.3.json.bin b/tests/_data/snapshots/pipenv/file_local_1.3.json.bin
index c450c714..2b17976e 100644
--- a/tests/_data/snapshots/pipenv/file_local_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_local_1.3.json.bin
@@ -92,6 +92,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_local_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.3.xml.bin
index d24ac95e..990af727 100644
--- a/tests/_data/snapshots/pipenv/file_local_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_local_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a">
diff --git a/tests/_data/snapshots/pipenv/file_local_1.4.json.bin b/tests/_data/snapshots/pipenv/file_local_1.4.json.bin
index 0a298451..ef125263 100644
--- a/tests/_data/snapshots/pipenv/file_local_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_local_1.4.json.bin
@@ -89,6 +89,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_local_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.4.xml.bin
index 6cf6c55b..50889d88 100644
--- a/tests/_data/snapshots/pipenv/file_local_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_local_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a">
diff --git a/tests/_data/snapshots/pipenv/file_local_1.5.json.bin b/tests/_data/snapshots/pipenv/file_local_1.5.json.bin
index f979f8f6..43c61ebd 100644
--- a/tests/_data/snapshots/pipenv/file_local_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_local_1.5.json.bin
@@ -89,6 +89,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_local_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_local_1.5.xml.bin
index 5152904f..71421f86 100644
--- a/tests/_data/snapshots/pipenv/file_local_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_local_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a">
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
index 0e68e583..51944f0f 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
@@ -17,6 +17,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
index bb7c9d9f..6b024c83 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
index c08f4eca..00aae6df 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
@@ -17,6 +17,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
index a6ae68bb..fdc1f9a7 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
index a25741c6..788abb29 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
@@ -17,6 +17,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
index 461db07e..05b343fe 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="root-component"/>
diff --git a/tests/_data/snapshots/pipenv/file_private-packages_1.3.json.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.3.json.bin
index d71bd4aa..20c79314 100644
--- a/tests/_data/snapshots/pipenv/file_private-packages_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_private-packages_1.3.json.bin
@@ -113,6 +113,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_private-packages_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.3.xml.bin
index 154e24d5..818da578 100644
--- a/tests/_data/snapshots/pipenv/file_private-packages_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_private-packages_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="numpy==1.26.2">
diff --git a/tests/_data/snapshots/pipenv/file_private-packages_1.4.json.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.4.json.bin
index af5b7b5b..ca448b73 100644
--- a/tests/_data/snapshots/pipenv/file_private-packages_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_private-packages_1.4.json.bin
@@ -113,6 +113,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_private-packages_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.4.xml.bin
index e3761d08..c2c5dbc8 100644
--- a/tests/_data/snapshots/pipenv/file_private-packages_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_private-packages_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="numpy==1.26.2">
diff --git a/tests/_data/snapshots/pipenv/file_private-packages_1.5.json.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.5.json.bin
index 0b545897..6f057c2b 100644
--- a/tests/_data/snapshots/pipenv/file_private-packages_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_private-packages_1.5.json.bin
@@ -113,6 +113,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_private-packages_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_private-packages_1.5.xml.bin
index 5833d110..dc6b7407 100644
--- a/tests/_data/snapshots/pipenv/file_private-packages_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_private-packages_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="numpy==1.26.2">
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
index 44836581..d94a3448 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.3.json.bin
@@ -1599,6 +1599,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
index 855f28f9..15f27e1e 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
index 02f063e8..641ff2d3 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.4.json.bin
@@ -1599,6 +1599,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
index eab607ee..8f34c5e4 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
index 0333f94b..9707f3a4 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.5.json.bin
@@ -1599,6 +1599,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
index 3dc514a0..c37a0619 100644
--- a/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-extras_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/file_with-urls_1.3.json.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.3.json.bin
index e1a2918c..0329fdce 100644
--- a/tests/_data/snapshots/pipenv/file_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-urls_1.3.json.bin
@@ -557,6 +557,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/file_with-urls_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.3.xml.bin
index 6462bf2d..eb868f4a 100644
--- a/tests/_data/snapshots/pipenv/file_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-urls_1.3.xml.bin
@@ -18,6 +18,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="certifi==2023.11.17">
diff --git a/tests/_data/snapshots/pipenv/file_with-urls_1.4.json.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.4.json.bin
index dfdbdfaa..3feac8eb 100644
--- a/tests/_data/snapshots/pipenv/file_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-urls_1.4.json.bin
@@ -553,6 +553,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_with-urls_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.4.xml.bin
index 5d311776..074cc88c 100644
--- a/tests/_data/snapshots/pipenv/file_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-urls_1.4.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="certifi==2023.11.17">
diff --git a/tests/_data/snapshots/pipenv/file_with-urls_1.5.json.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.5.json.bin
index 456367ce..2ca69834 100644
--- a/tests/_data/snapshots/pipenv/file_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_with-urls_1.5.json.bin
@@ -553,6 +553,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/file_with-urls_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_with-urls_1.5.xml.bin
index 17f3c9f2..b2c264d9 100644
--- a/tests/_data/snapshots/pipenv/file_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_with-urls_1.5.xml.bin
@@ -45,6 +45,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="certifi==2023.11.17">
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin
index 9c9504ac..e8443665 100644
--- a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.json.bin
@@ -103,6 +103,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin
index f04a1c02..6fa2d94e 100644
--- a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="numpy==1.26.2">
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin
index d32604bb..e33ce3cb 100644
--- a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.json.bin
@@ -103,6 +103,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin
index c7bb8ba7..c270f947 100644
--- a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="numpy==1.26.2">
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin
index 8da4444d..a375099f 100644
--- a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.json.bin
@@ -103,6 +103,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin
index 00092843..d4f0361d 100644
--- a/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/pypi-mirror_private-packages_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="numpy==1.26.2">
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin
index e56ecab7..d6e23efd 100644
--- a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.json.bin
@@ -272,6 +272,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin
index d7cd5fa9..784cefbd 100644
--- a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin
index acaedf8b..a78ebf22 100644
--- a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.json.bin
@@ -272,6 +272,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin
index b0b3a9af..5648fc50 100644
--- a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin
index daf7cd3b..7d64ee96 100644
--- a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.json.bin
@@ -272,6 +272,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin
index bb227a0f..5e96fad6 100644
--- a/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/some-categories_category-deps_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin
index 5395d5fa..209e8cb1 100644
--- a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.json.bin
@@ -235,6 +235,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin
index b947f9e8..be7b125e 100644
--- a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin
index 1b20c0ac..e0b64e60 100644
--- a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.json.bin
@@ -235,6 +235,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin
index ecafcdc3..a9b333bb 100644
--- a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin
index fa10aaf8..908c84e2 100644
--- a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.json.bin
@@ -235,6 +235,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin
index 1380989d..2ed5b691 100644
--- a/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/with-dev_default-and-dev_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow==1.3.0">
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
index f8c6b8a0..7c9ce9ab 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
@@ -321,6 +321,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
index 144913d9..f8a0a8d5 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
index 18d1e493..f90b33b5 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
@@ -321,6 +321,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
index 039c2b63..99a61427 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
index a1696501..155bcb7e 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
@@ -321,6 +321,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
index e17a8606..d9515fb0 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
index b6dde37b..5e7368e1 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
index b6cca933..085224be 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
index 1001840a..7e3db0bb 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
index 4d1549fd..6bb8b4c3 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
index 2888bf97..2a23a3b3 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
index 55a4759c..d2f38aca 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
index c7362720..8b631e7f 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
@@ -77,6 +77,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
index 652604dc..59b1587d 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
index c6aa1de9..22dd7272 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
@@ -77,6 +77,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
index 0d9d88be..c7fa4536 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
index 1aee68d4..a6752f97 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
@@ -77,6 +77,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
index 8a35f37d..c2e27207 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
index b2f470fb..799ca196 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
index 65da5a87..8c5b3db8 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
index 57ee0bd6..9b7c5e77 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
index e7e26904..26fe0e86 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
index 490beef1..7abf6e76 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
index db78b01a..7c158e6b 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
index b2f470fb..799ca196 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
index 65da5a87..8c5b3db8 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
index 57ee0bd6..9b7c5e77 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
index e7e26904..26fe0e86 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
index 490beef1..7abf6e76 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
index db78b01a..7c158e6b 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from local paths</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="package-a@23.42">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
index 8affa7d9..0b6c0c8f 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
@@ -245,6 +245,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
index 588b21a9..ceefbe21 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
index e4280ba1..003e0d62 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
@@ -245,6 +245,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
index ca716ae2..e084b603 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
index d97e04e6..0110a1b6 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
@@ -245,6 +245,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
index fe28a996..5218aa98 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
index 6ef9e0a5..6bf2d91c 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
@@ -317,6 +317,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
index 56ca6a9c..8669b5f9 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
index 8388725a..dfe326a2 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
@@ -317,6 +317,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
index d21af018..01af8426 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
index 0f641256..d4336606 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
@@ -317,6 +317,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
index bb1e72f9..e9cfa7ff 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
index 4a45bee2..e38ae0d9 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
index 214c6a82..7d0eee4d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
index 7707730a..775514f6 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
index 1c1b3501..afea6987 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
index fd1632c2..809b6e0a 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
index 7cf85b1a..16dbc8d9 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
index 76cf3cdb..332f4ffb 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
@@ -50,6 +50,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
index d437722a..d609a7fa 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
@@ -48,6 +48,9 @@
         </reference>
       </externalReferences>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="no-deps"/>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
index 0ce8883f..132c41c4 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
@@ -50,6 +50,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
index 6539cf43..f6545012 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
@@ -75,6 +75,9 @@
         </reference>
       </externalReferences>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="no-deps"/>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
index 4de17edb..e68a70f9 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
@@ -50,6 +50,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
index 65222440..d4a2a958 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
@@ -75,6 +75,9 @@
         </reference>
       </externalReferences>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="no-deps"/>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
index 7a0b172e..b1963871 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
index 8feff151..862e229d 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml@0.10.2">
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
index dae2642f..667fdaa3 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
index 35cae920..5f6bedbc 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml@0.10.2">
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
index 25d06d0b..f7dda794 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
index b5dd578e..69719a18 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml@0.10.2">
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
index 7a0b172e..b1963871 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
index 8feff151..862e229d 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml@0.10.2">
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
index dae2642f..667fdaa3 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
index 35cae920..5f6bedbc 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml@0.10.2">
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
index 25d06d0b..f7dda794 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
index b5dd578e..69719a18 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="toml@0.10.2">
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
index 09dd6f99..bdc1dcc8 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
@@ -237,6 +237,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
index 9f1a8ef2..c0883ed7 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
index 13c87910..768780f6 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
@@ -237,6 +237,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
index 7e917955..3cceb16c 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
index 07eda898..557f3a44 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
@@ -237,6 +237,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
index bb0190a0..426e4d09 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
index 76d89c39..893677fa 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
@@ -209,6 +209,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
index ac456821..b95ce7da 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
index d1c6ce92..96529c93 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
@@ -209,6 +209,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
index 752faa43..4f36ca4c 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
index f7ecb382..dc07211d 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
@@ -209,6 +209,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
index 9a36e99b..58279c6d 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
index a605c796..a59130b5 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
index 20615fd5..5ed17059 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
index 324f4d69..bc52832c 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
index 5b428ba3..573cce19 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
index 20ea9303..9b392530 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
@@ -101,6 +101,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
index 71bc1892..3b7bc58f 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
index fc5a992a..fdab87d0 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
@@ -1156,6 +1156,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
index 7e304357..8446a2cf 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
index a582fcc9..14a81265 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
@@ -1156,6 +1156,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
index 9ac75f7f..2431430b 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
index 12a19098..69c5b059 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
@@ -1156,6 +1156,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
index 53255d5f..a5d6bb77 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
index 1ab6a8d5..30e9be4a 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
@@ -1120,6 +1120,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
index 80d327a3..1cbf3707 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
index 86b2b9b5..734c8b91 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
@@ -1120,6 +1120,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
index 1188876f..9824e0cc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
index 028a832a..66414712 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
@@ -1120,6 +1120,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
index 6f669d69..bbbf7ebc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="colorama@0.4.6">
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
index cb1ca894..0a2f3a87 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
index c36da550..e83010ac 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>regression for issue #611</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="pyhumps@3.7.1">
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
index 89e08e07..28b52532 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
index 876ea47c..3e2d37c0 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>regression for issue #611</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="pyhumps@3.7.1">
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
index b225e59f..3f07b200 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
@@ -59,6 +59,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
index 77b3b946..fe3175ff 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>regression for issue #611</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="pyhumps@3.7.1">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
index 39abe83d..5088af8b 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
@@ -170,6 +170,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
index d4c956c8..fa7050b3 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
@@ -22,6 +22,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="boolean.py@4.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
index 7c4943dd..a04a5d1a 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
@@ -170,6 +170,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
index c9333332..cc4ba787 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
@@ -49,6 +49,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="boolean.py@4.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
index 3e44318f..bfeaa928 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
@@ -170,6 +170,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
index 12e32276..a23f8981 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
@@ -49,6 +49,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="boolean.py@4.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
index c37f9529..8fe68cb9 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
@@ -2117,6 +2117,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
index 5ade7e85..f72b3a59 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
@@ -22,6 +22,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
index 886f0baf..3cb68473 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
@@ -2117,6 +2117,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
index a09b90b7..e44170fa 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
@@ -49,6 +49,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
index cbdaaac4..c37085fc 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
@@ -2117,6 +2117,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
index 85dbdc63..0c8f6a82 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
@@ -49,6 +49,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
index 37170e79..6adc36ef 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
@@ -3163,6 +3163,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
index dbf7f1ef..ac579c1f 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
@@ -22,6 +22,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
index 7f8decc1..4ee45fb8 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
@@ -3163,6 +3163,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
index 4d94f970..e5011131 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
@@ -49,6 +49,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
index 152269f5..07814609 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
@@ -3163,6 +3163,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
index 75f5407b..c4effd6e 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
@@ -49,6 +49,9 @@
         <property name="cdx:python:package:required-extra">my-extra</property>
       </properties>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
index b5459389..8bae5aea 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
@@ -325,6 +325,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
index 31002850..af433927 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
index 270a242e..035b6d1c 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
@@ -325,6 +325,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
index 91dea11d..0362fc2f 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
index efee818b..74c673a4 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
@@ -325,6 +325,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
index a00e46b0..370f7753 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
index f52a15e1..378bdc31 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
index 2138d5ec..a0ad8a44 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
index 166f9e2f..742375a5 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
index 80614ff3..c62a1516 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
index f2006a4d..f13eb38d 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
@@ -293,6 +293,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
index 39025b2c..8d3c8b2d 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="arrow@1.3.0">
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
index eb6a9ec9..a751b6ec 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
index f1ee87bd..8a925f4f 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
index c4275512..a0628524 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
index 7b67d0f9..b4f8191b 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
index 707fb92c..b1ba942b 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
index c4f928d2..d2ea971e 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
index eb6a9ec9..a751b6ec 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
index f1ee87bd..8a925f4f 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
index c4275512..a0628524 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
index 7b67d0f9..b4f8191b 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
index 707fb92c..b1ba942b 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
index c4f928d2..d2ea971e 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
index eb6a9ec9..a751b6ec 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
index f1ee87bd..8a925f4f 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
index c4275512..a0628524 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
index 7b67d0f9..b4f8191b 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
index 707fb92c..b1ba942b 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
@@ -13,6 +13,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
index c4f928d2..d2ea971e 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <dependencies>
     <dependency ref="with-extras"/>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
index 93276657..4e2d86ef 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
@@ -130,6 +130,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
index 38d12e37..ccd1a1be 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
index 0ea86c8b..9ae1a00e 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
@@ -130,6 +130,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
index c5fc92d4..a45c5c08 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
index 30d2bb7b..d0dc7b6c 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
@@ -130,6 +130,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
index 0258a02f..e49d1d6e 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
index 03c1cd2e..f3213fc0 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
@@ -138,6 +138,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
index 525bc6f0..3011ef0d 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
index 9e4a41dd..c6036268 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
@@ -138,6 +138,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
index fa3526cb..c56d5f70 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
index 674c8c1f..602b7f77 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
@@ -138,6 +138,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
index eefb84ff..f32fabe2 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
index 08e927ee..217b31e8 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
@@ -150,6 +150,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
index 3599f763..4d5a71a5 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
@@ -19,6 +19,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
index 988cb6e2..51efd3c8 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
@@ -150,6 +150,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
index 3fe09d88..a9a79d94 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
index 03b723d7..2204f69d 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
@@ -150,6 +150,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
index 8c7f7b5d..ad53ea7f 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
@@ -46,6 +46,9 @@
       <version>0.1.0</version>
       <description>packages from direct urls</description>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="Pillow@10.1.0">
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin b/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
index a909ee08..d0534648 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
@@ -65,6 +65,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin b/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
index 550ede05..44969e9a 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin b/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
index 636d3ffc..eaeb8f7e 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
@@ -65,6 +65,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin b/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
index 63850b70..fe282242 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin b/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
index 5953eb83..22ba17a5 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
@@ -65,6 +65,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin b/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
index 82bdbd9d..6bb58f28 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_local_1.3.json.bin b/tests/_data/snapshots/requirements/file_local_1.3.json.bin
index 1fa457f5..2f791bad 100644
--- a/tests/_data/snapshots/requirements/file_local_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.3.json.bin
@@ -127,6 +127,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_local_1.3.xml.bin b/tests/_data/snapshots/requirements/file_local_1.3.xml.bin
index 403c5db8..1c202b23 100644
--- a/tests/_data/snapshots/requirements/file_local_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_local_1.4.json.bin b/tests/_data/snapshots/requirements/file_local_1.4.json.bin
index dd07799b..0b1c1df9 100644
--- a/tests/_data/snapshots/requirements/file_local_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.4.json.bin
@@ -122,6 +122,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_local_1.4.xml.bin b/tests/_data/snapshots/requirements/file_local_1.4.xml.bin
index bdf039c6..1791cb7d 100644
--- a/tests/_data/snapshots/requirements/file_local_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_local_1.5.json.bin b/tests/_data/snapshots/requirements/file_local_1.5.json.bin
index a1da370d..b4cbfb5c 100644
--- a/tests/_data/snapshots/requirements/file_local_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.5.json.bin
@@ -122,6 +122,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_local_1.5.xml.bin b/tests/_data/snapshots/requirements/file_local_1.5.xml.bin
index 8487093f..2b7e2712 100644
--- a/tests/_data/snapshots/requirements/file_local_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_nested_1.3.json.bin b/tests/_data/snapshots/requirements/file_nested_1.3.json.bin
index a909ee08..d0534648 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.3.json.bin
@@ -65,6 +65,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin b/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
index 550ede05..44969e9a 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_nested_1.4.json.bin b/tests/_data/snapshots/requirements/file_nested_1.4.json.bin
index 636d3ffc..eaeb8f7e 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.4.json.bin
@@ -65,6 +65,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin b/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
index 63850b70..fe282242 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_nested_1.5.json.bin b/tests/_data/snapshots/requirements/file_nested_1.5.json.bin
index 5953eb83..22ba17a5 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.5.json.bin
@@ -65,6 +65,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin b/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
index 82bdbd9d..6bb58f28 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin b/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
index d8e0373d..8a060a9d 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin b/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
index fd12d8ff..f6587742 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin b/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
index 6bed45d8..ccf4350f 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin b/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
index 0d3cdbaa..5a83c1cc 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin b/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
index 7bbc91fc..bf252450 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin b/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
index 5fb2ea84..d5edbe76 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
index 64ec9b6b..1598a9bd 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
@@ -73,6 +73,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
index 4c1d765f..c31bfae8 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
index ccd57626..a7333582 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
@@ -70,6 +70,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
index c9d606ed..99dd4ab9 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
index a642b533..c91f2491 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
@@ -70,6 +70,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
index 9bf8476d..d0e9c94d 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
index 03e76120..d0100540 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
@@ -109,6 +109,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
index c1c509aa..d07a8b6a 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
index cd8fc1eb..853118bb 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
@@ -109,6 +109,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
index 59b2551c..647e9ce3 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
index bb2dd25f..b98b9144 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
@@ -109,6 +109,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
index 66eac740..f52f1f90 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
index f2be6263..d0fd31d5 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
index 187ad4bb..79eac39a 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
index 8e4a57d8..f534b553 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
index 59846d93..0984799d 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
index 27aac3e8..f13a4eb1 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
@@ -47,6 +47,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
index 196acabc..3309fd71 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
index 2d083671..1d8df625 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
@@ -149,6 +149,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
index e6c297d2..5d56cf9a 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
index 392da2f5..b58bc387 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
@@ -148,6 +148,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
index 14a54e8d..1e46eb1e 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
index 6b8002aa..b527a4cf 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
@@ -148,6 +148,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
index 519512fc..afff1cab 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
index 64ecb03e..0b1f799d 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
@@ -144,6 +144,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
index 0a00b1da..8bd5ed10 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
index 240879c8..74c8c901 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
@@ -138,6 +138,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
index 7974354e..0fa54467 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
index 168903b3..9c58e7a9 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
@@ -138,6 +138,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
index c9d945c5..e449a302 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
index 8a88058c..e77bfff4 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
@@ -73,6 +73,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
index ee8ccc80..c25d0c94 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
@@ -21,6 +21,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
index 3edd3f6a..1dc26a60 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
@@ -70,6 +70,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
index 83893d01..0d2bbbb0 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
index 33d1f35d..843e8a03 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
@@ -70,6 +70,12 @@
       "type": "application",
       "version": "0.1.0"
     },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
index 70437316..57709bf9 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
@@ -48,6 +48,9 @@
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
     </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/stream_frozen_1.3.json.bin b/tests/_data/snapshots/requirements/stream_frozen_1.3.json.bin
index 721c5238..068fac17 100644
--- a/tests/_data/snapshots/requirements/stream_frozen_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_frozen_1.3.json.bin
@@ -50,6 +50,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_frozen_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_frozen_1.3.xml.bin
index c5c0f0dd..ee8e01bf 100644
--- a/tests/_data/snapshots/requirements/stream_frozen_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_frozen_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/stream_frozen_1.4.json.bin b/tests/_data/snapshots/requirements/stream_frozen_1.4.json.bin
index 017055f9..061b38f4 100644
--- a/tests/_data/snapshots/requirements/stream_frozen_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_frozen_1.4.json.bin
@@ -50,6 +50,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_frozen_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_frozen_1.4.xml.bin
index d0e82183..727195a8 100644
--- a/tests/_data/snapshots/requirements/stream_frozen_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_frozen_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/stream_frozen_1.5.json.bin b/tests/_data/snapshots/requirements/stream_frozen_1.5.json.bin
index 6ae1a512..34f08357 100644
--- a/tests/_data/snapshots/requirements/stream_frozen_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_frozen_1.5.json.bin
@@ -50,6 +50,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_frozen_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_frozen_1.5.xml.bin
index 154250b1..2e7f305e 100644
--- a/tests/_data/snapshots/requirements/stream_frozen_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_frozen_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/stream_local_1.3.json.bin b/tests/_data/snapshots/requirements/stream_local_1.3.json.bin
index 1eb4b4c8..3305ce77 100644
--- a/tests/_data/snapshots/requirements/stream_local_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_local_1.3.json.bin
@@ -112,6 +112,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_local_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_local_1.3.xml.bin
index fb576405..d5004cdd 100644
--- a/tests/_data/snapshots/requirements/stream_local_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_local_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_local_1.4.json.bin b/tests/_data/snapshots/requirements/stream_local_1.4.json.bin
index 9e461821..c2aae1ed 100644
--- a/tests/_data/snapshots/requirements/stream_local_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_local_1.4.json.bin
@@ -107,6 +107,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_local_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_local_1.4.xml.bin
index 02871a38..0c9851a0 100644
--- a/tests/_data/snapshots/requirements/stream_local_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_local_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_local_1.5.json.bin b/tests/_data/snapshots/requirements/stream_local_1.5.json.bin
index b4727344..26d5a67f 100644
--- a/tests/_data/snapshots/requirements/stream_local_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_local_1.5.json.bin
@@ -107,6 +107,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_local_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_local_1.5.xml.bin
index b81decfc..3f9475c4 100644
--- a/tests/_data/snapshots/requirements/stream_local_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_local_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_nested_1.3.json.bin b/tests/_data/snapshots/requirements/stream_nested_1.3.json.bin
index ae6bb18c..b5de47bc 100644
--- a/tests/_data/snapshots/requirements/stream_nested_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_nested_1.3.json.bin
@@ -1,5 +1,11 @@
 {
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_nested_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_nested_1.3.xml.bin
index 77546d46..f275e185 100644
--- a/tests/_data/snapshots/requirements/stream_nested_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_nested_1.3.xml.bin
@@ -13,5 +13,8 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
 </bom>
diff --git a/tests/_data/snapshots/requirements/stream_nested_1.4.json.bin b/tests/_data/snapshots/requirements/stream_nested_1.4.json.bin
index 0ca4ef15..b15333df 100644
--- a/tests/_data/snapshots/requirements/stream_nested_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_nested_1.4.json.bin
@@ -1,5 +1,11 @@
 {
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_nested_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_nested_1.4.xml.bin
index 27fa7639..2e149caf 100644
--- a/tests/_data/snapshots/requirements/stream_nested_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_nested_1.4.xml.bin
@@ -40,5 +40,8 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
 </bom>
diff --git a/tests/_data/snapshots/requirements/stream_nested_1.5.json.bin b/tests/_data/snapshots/requirements/stream_nested_1.5.json.bin
index 73ba6b6d..10545fd6 100644
--- a/tests/_data/snapshots/requirements/stream_nested_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_nested_1.5.json.bin
@@ -1,5 +1,11 @@
 {
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_nested_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_nested_1.5.xml.bin
index 5c6fa3bd..c1edb281 100644
--- a/tests/_data/snapshots/requirements/stream_nested_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_nested_1.5.xml.bin
@@ -40,5 +40,8 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
 </bom>
diff --git a/tests/_data/snapshots/requirements/stream_private-packages_1.3.json.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.3.json.bin
index acfb396c..bde98fda 100644
--- a/tests/_data/snapshots/requirements/stream_private-packages_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_private-packages_1.3.json.bin
@@ -32,6 +32,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_private-packages_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.3.xml.bin
index 0fd61ff9..db5d2edd 100644
--- a/tests/_data/snapshots/requirements/stream_private-packages_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_private-packages_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/stream_private-packages_1.4.json.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.4.json.bin
index 1ca174e5..599e5d39 100644
--- a/tests/_data/snapshots/requirements/stream_private-packages_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_private-packages_1.4.json.bin
@@ -32,6 +32,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_private-packages_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.4.xml.bin
index 1c749b7d..f823ed66 100644
--- a/tests/_data/snapshots/requirements/stream_private-packages_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_private-packages_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/stream_private-packages_1.5.json.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.5.json.bin
index 309d0f87..bd816962 100644
--- a/tests/_data/snapshots/requirements/stream_private-packages_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_private-packages_1.5.json.bin
@@ -32,6 +32,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_private-packages_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_private-packages_1.5.xml.bin
index d56eef48..5c7fb76e 100644
--- a/tests/_data/snapshots/requirements/stream_private-packages_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_private-packages_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L7">
diff --git a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.json.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.json.bin
index 33edf346..08abcc42 100644
--- a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.json.bin
@@ -58,6 +58,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.xml.bin
index c0227f2c..dc238323 100644
--- a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
diff --git a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.json.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.json.bin
index 07dc044d..4e3191ed 100644
--- a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.json.bin
@@ -55,6 +55,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.xml.bin
index 39b06991..76c28c3d 100644
--- a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
diff --git a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.json.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.json.bin
index c8a937a5..a84dc58c 100644
--- a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.json.bin
@@ -55,6 +55,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.xml.bin
index 73f295e4..80d2b709 100644
--- a/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_regression-issue448.cp1252.txt_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L6">
diff --git a/tests/_data/snapshots/requirements/stream_with-comments_1.3.json.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.3.json.bin
index 6f64580d..7b3d8776 100644
--- a/tests/_data/snapshots/requirements/stream_with-comments_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-comments_1.3.json.bin
@@ -94,6 +94,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_with-comments_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.3.xml.bin
index e16dafc2..d9d799e8 100644
--- a/tests/_data/snapshots/requirements/stream_with-comments_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-comments_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/stream_with-comments_1.4.json.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.4.json.bin
index 9e2a8e28..c99c861c 100644
--- a/tests/_data/snapshots/requirements/stream_with-comments_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-comments_1.4.json.bin
@@ -94,6 +94,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-comments_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.4.xml.bin
index 743ded61..c011eb93 100644
--- a/tests/_data/snapshots/requirements/stream_with-comments_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-comments_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/stream_with-comments_1.5.json.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.5.json.bin
index 292292fb..726eaaae 100644
--- a/tests/_data/snapshots/requirements/stream_with-comments_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-comments_1.5.json.bin
@@ -94,6 +94,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-comments_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_with-comments_1.5.xml.bin
index cc7d80dd..129e6e6a 100644
--- a/tests/_data/snapshots/requirements/stream_with-comments_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-comments_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
index 3a10febe..b4cf779a 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.3.json.bin
@@ -32,6 +32,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
index accd61eb..b29201bb 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
index 5c282291..f0cfb8fa 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.4.json.bin
@@ -32,6 +32,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
index b7d9f55c..b7f56e22 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
index 30a51bb8..325e006a 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.5.json.bin
@@ -32,6 +32,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
index f049804c..74aec2b5 100644
--- a/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-extras_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L3">
diff --git a/tests/_data/snapshots/requirements/stream_with-hashes_1.3.json.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.3.json.bin
index ae2f9cda..e79cc532 100644
--- a/tests/_data/snapshots/requirements/stream_with-hashes_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-hashes_1.3.json.bin
@@ -134,6 +134,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_with-hashes_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.3.xml.bin
index 0b03d9a0..19268fb6 100644
--- a/tests/_data/snapshots/requirements/stream_with-hashes_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-hashes_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_with-hashes_1.4.json.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.4.json.bin
index d5d98b8f..e6900ba4 100644
--- a/tests/_data/snapshots/requirements/stream_with-hashes_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-hashes_1.4.json.bin
@@ -133,6 +133,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-hashes_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.4.xml.bin
index f52bca08..125511c5 100644
--- a/tests/_data/snapshots/requirements/stream_with-hashes_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-hashes_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_with-hashes_1.5.json.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.5.json.bin
index 8bc5d913..ab9f4364 100644
--- a/tests/_data/snapshots/requirements/stream_with-hashes_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-hashes_1.5.json.bin
@@ -133,6 +133,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-hashes_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_with-hashes_1.5.xml.bin
index 891a8045..ac15f36e 100644
--- a/tests/_data/snapshots/requirements/stream_with-hashes_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-hashes_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_with-urls_1.3.json.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.3.json.bin
index ab5d1242..c3c05da3 100644
--- a/tests/_data/snapshots/requirements/stream_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-urls_1.3.json.bin
@@ -129,6 +129,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_with-urls_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.3.xml.bin
index ee1b960c..49465b70 100644
--- a/tests/_data/snapshots/requirements/stream_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-urls_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_with-urls_1.4.json.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.4.json.bin
index b60d3a46..06cca52c 100644
--- a/tests/_data/snapshots/requirements/stream_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-urls_1.4.json.bin
@@ -123,6 +123,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-urls_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.4.xml.bin
index 0563d7c4..97584405 100644
--- a/tests/_data/snapshots/requirements/stream_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-urls_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_with-urls_1.5.json.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.5.json.bin
index 7cf43bb0..cb584904 100644
--- a/tests/_data/snapshots/requirements/stream_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_with-urls_1.5.json.bin
@@ -123,6 +123,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_with-urls_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_with-urls_1.5.xml.bin
index 8d782f29..63a9925d 100644
--- a/tests/_data/snapshots/requirements/stream_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_with-urls_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L11">
diff --git a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.json.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.json.bin
index 1e3fe2ac..d3777e03 100644
--- a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.json.bin
@@ -58,6 +58,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "name": "cyclonedx-bom",
diff --git a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.xml.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.xml.bin
index c944348c..6a3dcd48 100644
--- a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.3.xml.bin
@@ -13,6 +13,9 @@
         <version>libVersion-testing</version>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.json.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.json.bin
index 0be6cbd0..7c973b8d 100644
--- a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.json.bin
@@ -55,6 +55,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.xml.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.xml.bin
index c6b3b32e..944db4b2 100644
--- a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.4.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.json.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.json.bin
index c782828c..1e3d62d7 100644
--- a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.json.bin
@@ -55,6 +55,12 @@
     }
   ],
   "metadata": {
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
     "tools": [
       {
         "externalReferences": [   ],
diff --git a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.xml.bin b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.xml.bin
index 9092c6b6..bab446e4 100644
--- a/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/stream_without-pinned-versions_1.5.xml.bin
@@ -40,6 +40,9 @@
         <externalReferences><!-- stripped --></externalReferences>
       </tool>
     </tools>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
   </metadata>
   <components>
     <component type="library" bom-ref="requirements-L1">
diff --git a/tests/integration/test_cli_environment.py b/tests/integration/test_cli_environment.py
index a25e716d..6ce23b1e 100644
--- a/tests/integration/test_cli_environment.py
+++ b/tests/integration/test_cli_environment.py
@@ -137,6 +137,7 @@ def test_with_current_python(self) -> None:
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     # no project dir -> search in current python
                 ])
@@ -152,6 +153,7 @@ def test_with_current_python(self) -> None:
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     executable  # explicitly current python
                 ])
@@ -174,6 +176,7 @@ def test_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: Out
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     f'--pyproject={join(projectdir, "pyproject.toml")}',
                     join(projectdir, '.venv')])
diff --git a/tests/integration/test_cli_pipenv.py b/tests/integration/test_cli_pipenv.py
index d792a1cf..adc98f51 100644
--- a/tests/integration/test_cli_pipenv.py
+++ b/tests/integration/test_cli_pipenv.py
@@ -96,6 +96,7 @@ def test_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: Out
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     f'--pyproject={join(projectdir, "pyproject.toml")}',
                     projectdir])
@@ -115,6 +116,7 @@ def test_with_categories_as_expected(self, projectdir: str, sv: SchemaVersion, o
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     '--categories', 'categoryB,groupA packages,dev-packages',
                     projectdir])
@@ -134,6 +136,7 @@ def test_with_dev_as_expected(self, projectdir: str, sv: SchemaVersion, of: Outp
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     '--dev',
                     projectdir])
@@ -153,6 +156,7 @@ def test_with_pypi_mirror_as_expected(self, projectdir: str, sv: SchemaVersion,
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     '--pypi-mirror', 'https://pypy-mirror.testing.acme.org/simple',
                     projectdir])
diff --git a/tests/integration/test_cli_poetry.py b/tests/integration/test_cli_poetry.py
index c7eddbd7..05b43513 100644
--- a/tests/integration/test_cli_poetry.py
+++ b/tests/integration/test_cli_poetry.py
@@ -127,6 +127,7 @@ def test_with_file_as_expected(self, projectdir: str, sv: SchemaVersion, of: Out
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     projectdir])
             err = err.getvalue()
@@ -147,6 +148,7 @@ def test_with_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: O
                     '--without', 'groupB,dev',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     projectdir])
             err = err.getvalue()
@@ -166,6 +168,7 @@ def test_only_groups_as_expected(self, projectdir: str, sv: SchemaVersion, of: O
                     '--only', 'groupB',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     projectdir])
             err = err.getvalue()
@@ -185,6 +188,7 @@ def test_nodev_as_expected(self, projectdir: str, sv: SchemaVersion, of: OutputF
                     '--no-dev',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     projectdir])
             err = err.getvalue()
@@ -204,6 +208,7 @@ def test_with_extras_as_expected(self, projectdir: str, sv: SchemaVersion, of: O
                     '-E', 'my-extra',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     projectdir])
             err = err.getvalue()
diff --git a/tests/integration/test_cli_requirements.py b/tests/integration/test_cli_requirements.py
index d6c48211..36b89f2a 100644
--- a/tests/integration/test_cli_requirements.py
+++ b/tests/integration/test_cli_requirements.py
@@ -104,6 +104,7 @@ def test_with_file_as_expected(self, infile: str, sv: SchemaVersion, of: OutputF
                     '-vvv',
                     f'--sv={sv.to_version()}',
                     f'--of={of.name}',
+                    '--output-reproducible',
                     '--outfile=-',
                     f'--pyproject={pyproject_file}',
                     infile])
@@ -124,6 +125,7 @@ def test_with_stream_as_expected(self, infile: str, sv: SchemaVersion, of: Outpu
                         '-vvv',
                         f'--sv={sv.to_version()}',
                         f'--of={of.name}',
+                        '--output-reproducible',
                         '--outfile=-',
                         # no pyproject for this case
                         '-'])
diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py
index 373567d4..aff2ff06 100644
--- a/tests/unit/test_cli.py
+++ b/tests/unit/test_cli.py
@@ -77,6 +77,7 @@ def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
                 schema_version=SchemaVersion.V1_4,
                 output_format=OutputFormat.JSON,
                 should_validate=True,
+                output_reproducible=True,
                 _bbc=MyBBC
             )
             command(outfile=outs)
@@ -99,10 +100,11 @@ def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
                 short_purls=False,
                 schema_version=SchemaVersion.V1_4,
                 output_format=OutputFormat.JSON,
+                output_reproducible=False,
                 should_validate=True,
                 _bbc=MyBBC
             )
-            command._make_output = Mock(return_value='["invalid to CDX schema"]')
+            command._make_output = Mock(return_value=r'["invalid to CDX schema"]')
 
             with self.assertRaisesRegex(ValueError, 'is schema-invalid'):
                 command(outfile=outs)
@@ -122,16 +124,17 @@ def __new__(cls, *args: Any, **kwargs: Any) -> BomBuilder:
                 schema_version=SchemaVersion.V1_4,
                 output_format=OutputFormat.JSON,
                 should_validate=False,
+                output_reproducible=False,
                 _bbc=MyBBC
             )
-            command._make_output = Mock(return_value='["invalid to CDX schema"]')
+            command._make_output = Mock(return_value=r'["invalid to CDX schema"]')
 
             command(outfile=outs)
 
             log = logs.getvalue()
             out = outs.getvalue()
 
-        self.assertEqual('["invalid to CDX schema"]', out)
+        self.assertEqual(r'["invalid to CDX schema"]', out)
         self.assertIn('WARNING: Validation skipped', log)
 
     def assertEqualSnapshot(self, actual: str, snapshot_name: str) -> None:  # noqa: N802

From 8a46bd78c2bd4d8f5b3ae149feb60039a71d5bc2 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 22 Dec 2023 22:34:23 +0100
Subject: [PATCH 150/155] docs

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/environment.py  | 2 +-
 cyclonedx_py/_internal/pipenv.py       | 3 ++-
 cyclonedx_py/_internal/requirements.py | 5 +++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index 9d9c7a82..f6649b48 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -105,7 +105,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        type=argparse_type4enum(ComponentType),
                        default=ComponentType.APPLICATION)
         # TODO possible additional switch:
-        #  `--exclude <package>` Exclude specified package from the output
+        #  `--exclude <package>` Exclude specified package from the output (multi use)
         #  `--local`        If in a virtualenv that has global access, do not list globally-installed packages.
         #  `--user`         Only output packages installed in user-site.
         #  `--path <path>`  Restrict to the specified installation path for listing packages
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 9f0e7b01..6fafb4f7 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -304,4 +304,5 @@ def __purl_qualifiers4lock(self, data: 'NameDict', sourcees: Dict[str, str]) ->
         return qs
 
     def __make_dependency_graph(self) -> None:
-        pass  # TODO: gather info from `pipenv graph --json-tree` and work with it
+        # possible solution:: gather info from `pipenv graph --json-tree` and work with it
+        pass
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 53103791..ca432e21 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -101,8 +101,9 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        type=argparse_type4enum(ComponentType),
                        default=ComponentType.APPLICATION)
         p.add_argument('requirements_file',
-                       metavar='requirements-file',
-                       help='I HELP TODO (default: %(default)r in current working directory)',
+                       metavar='REQUIREMENTS-FILE',
+                       help='Requirements file (default: %(default)r in current working directory).\n'
+                            'May be set to "-" to read from <stdin>.',
                        nargs=OPTIONAL,
                        default='requirements.txt')
         return p

From 35587db43308c2028549b1c957523933a20b7860 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 22 Dec 2023 23:58:26 +0100
Subject: [PATCH 151/155] ci: simplify self-test (#635)

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/python.yml | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index f3d97d70..4be2eb0c 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -145,15 +145,10 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
           architecture: 'x64'
-      - name: Install poetry
-        # see https://github.com/marketplace/actions/setup-poetry
-        uses: Gr1N/setup-poetry@v8
-        with:
-          poetry-version: ${{ env.POETRY_VERSION }}
-      - name: Install dependencies
-        run: poetry install --no-dev
+      - name: Install self
+        run: pip install .
       - name: run command
-        run: poetry run ${{matrix.command}}
+        run: ${{matrix.command}}
 
   build-and-test:
     name: Test (${{ matrix.os }} py${{ matrix.python-version }})

From d06698c50bb38778944fe9f8d66a9bdc81e3814a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 22 Dec 2023 23:59:33 +0100
Subject: [PATCH 152/155] Rewrite 4 more pyproject (#634)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/poetry.py              |   4 +-
 cyclonedx_py/_internal/utils/cdx.py           |   1 +
 cyclonedx_py/_internal/utils/packaging.py     |  32 ++--
 cyclonedx_py/_internal/utils/pep621.py        |  25 ++-
 cyclonedx_py/_internal/utils/pyproject.py     |   9 +
 .../environment/no-deps/pyproject.toml        |  15 +-
 .../environment/with-extras/pyproject.toml    |  40 +----
 .../infiles/pipenv/no-deps/pyproject.toml     |  15 +-
 .../poetry/no-deps/pyproject-proto.toml       |   2 +
 .../_data/infiles/requirements/pyproject.toml |  15 +-
 .../venv_editable-self_1.1.xml.bin            |   2 +-
 .../venv_editable-self_1.2.json.bin           |   2 +-
 .../venv_editable-self_1.2.xml.bin            |   2 +-
 .../venv_editable-self_1.3.json.bin           |   2 +-
 .../venv_editable-self_1.3.xml.bin            |   2 +-
 .../venv_editable-self_1.4.json.bin           |   2 +-
 .../venv_editable-self_1.4.xml.bin            |   2 +-
 .../venv_editable-self_1.5.json.bin           |   2 +-
 .../venv_editable-self_1.5.xml.bin            |   2 +-
 .../environment/venv_no-deps_1.2.json.bin     |  32 ++++
 .../environment/venv_no-deps_1.2.xml.bin      |  26 +++
 .../environment/venv_no-deps_1.3.json.bin     |  32 ++++
 .../environment/venv_no-deps_1.3.xml.bin      |  26 +++
 .../environment/venv_no-deps_1.4.json.bin     |  32 ++++
 .../environment/venv_no-deps_1.4.xml.bin      |  26 +++
 .../environment/venv_no-deps_1.5.json.bin     |  32 ++++
 .../environment/venv_no-deps_1.5.xml.bin      |  26 +++
 .../environment/venv_with-extras_1.1.xml.bin  | 156 ++++++++---------
 .../environment/venv_with-extras_1.2.json.bin | 165 +++++++++---------
 .../environment/venv_with-extras_1.2.xml.bin  | 163 +++++++++--------
 .../environment/venv_with-extras_1.3.json.bin | 165 +++++++++---------
 .../environment/venv_with-extras_1.3.xml.bin  | 163 +++++++++--------
 .../environment/venv_with-extras_1.4.json.bin | 165 +++++++++---------
 .../environment/venv_with-extras_1.4.xml.bin  | 163 +++++++++--------
 .../environment/venv_with-extras_1.5.json.bin | 165 +++++++++---------
 .../environment/venv_with-extras_1.5.xml.bin  | 163 +++++++++--------
 .../environment/venv_with-urls_1.1.xml.bin    |  14 +-
 .../environment/venv_with-urls_1.2.json.bin   |  14 +-
 .../environment/venv_with-urls_1.2.xml.bin    |  14 +-
 .../environment/venv_with-urls_1.3.json.bin   |  14 +-
 .../environment/venv_with-urls_1.3.xml.bin    |  14 +-
 .../environment/venv_with-urls_1.4.json.bin   |  14 +-
 .../environment/venv_with-urls_1.4.xml.bin    |  14 +-
 .../environment/venv_with-urls_1.5.json.bin   |  14 +-
 .../environment/venv_with-urls_1.5.xml.bin    |  14 +-
 .../pipenv/file_no-deps_1.2.json.bin          |  32 ++++
 .../snapshots/pipenv/file_no-deps_1.2.xml.bin |  26 +++
 .../pipenv/file_no-deps_1.3.json.bin          |  32 ++++
 .../snapshots/pipenv/file_no-deps_1.3.xml.bin |  26 +++
 .../pipenv/file_no-deps_1.4.json.bin          |  32 ++++
 .../snapshots/pipenv/file_no-deps_1.4.xml.bin |  26 +++
 .../pipenv/file_no-deps_1.5.json.bin          |  32 ++++
 .../snapshots/pipenv/file_no-deps_1.5.xml.bin |  26 +++
 .../poetry/no-deps_lock20_1.2.json.bin        |  12 +-
 .../poetry/no-deps_lock20_1.2.xml.bin         |  12 +-
 .../poetry/no-deps_lock20_1.3.json.bin        |  12 +-
 .../poetry/no-deps_lock20_1.3.xml.bin         |  12 +-
 .../poetry/no-deps_lock20_1.4.json.bin        |  12 +-
 .../poetry/no-deps_lock20_1.4.xml.bin         |  12 +-
 .../poetry/no-deps_lock20_1.5.json.bin        |  12 +-
 .../poetry/no-deps_lock20_1.5.xml.bin         |  12 +-
 .../requirements/file_frozen_1.2.json.bin     |  32 ++++
 .../requirements/file_frozen_1.2.xml.bin      |  26 +++
 .../requirements/file_frozen_1.3.json.bin     |  32 ++++
 .../requirements/file_frozen_1.3.xml.bin      |  26 +++
 .../requirements/file_frozen_1.4.json.bin     |  32 ++++
 .../requirements/file_frozen_1.4.xml.bin      |  26 +++
 .../requirements/file_frozen_1.5.json.bin     |  32 ++++
 .../requirements/file_frozen_1.5.xml.bin      |  26 +++
 .../requirements/file_local_1.2.json.bin      |  32 ++++
 .../requirements/file_local_1.2.xml.bin       |  26 +++
 .../requirements/file_local_1.3.json.bin      |  32 ++++
 .../requirements/file_local_1.3.xml.bin       |  26 +++
 .../requirements/file_local_1.4.json.bin      |  32 ++++
 .../requirements/file_local_1.4.xml.bin       |  26 +++
 .../requirements/file_local_1.5.json.bin      |  32 ++++
 .../requirements/file_local_1.5.xml.bin       |  26 +++
 .../requirements/file_nested_1.2.json.bin     |  32 ++++
 .../requirements/file_nested_1.2.xml.bin      |  26 +++
 .../requirements/file_nested_1.3.json.bin     |  32 ++++
 .../requirements/file_nested_1.3.xml.bin      |  26 +++
 .../requirements/file_nested_1.4.json.bin     |  32 ++++
 .../requirements/file_nested_1.4.xml.bin      |  26 +++
 .../requirements/file_nested_1.5.json.bin     |  32 ++++
 .../requirements/file_nested_1.5.xml.bin      |  26 +++
 .../file_private-packages_1.2.json.bin        |  32 ++++
 .../file_private-packages_1.2.xml.bin         |  26 +++
 .../file_private-packages_1.3.json.bin        |  32 ++++
 .../file_private-packages_1.3.xml.bin         |  26 +++
 .../file_private-packages_1.4.json.bin        |  32 ++++
 .../file_private-packages_1.4.xml.bin         |  26 +++
 .../file_private-packages_1.5.json.bin        |  32 ++++
 .../file_private-packages_1.5.xml.bin         |  26 +++
 ...egression-issue448.cp1252.txt_1.2.json.bin |  32 ++++
 ...regression-issue448.cp1252.txt_1.2.xml.bin |  26 +++
 ...egression-issue448.cp1252.txt_1.3.json.bin |  32 ++++
 ...regression-issue448.cp1252.txt_1.3.xml.bin |  26 +++
 ...egression-issue448.cp1252.txt_1.4.json.bin |  32 ++++
 ...regression-issue448.cp1252.txt_1.4.xml.bin |  26 +++
 ...egression-issue448.cp1252.txt_1.5.json.bin |  32 ++++
 ...regression-issue448.cp1252.txt_1.5.xml.bin |  26 +++
 .../file_with-comments_1.2.json.bin           |  32 ++++
 .../file_with-comments_1.2.xml.bin            |  26 +++
 .../file_with-comments_1.3.json.bin           |  32 ++++
 .../file_with-comments_1.3.xml.bin            |  26 +++
 .../file_with-comments_1.4.json.bin           |  32 ++++
 .../file_with-comments_1.4.xml.bin            |  26 +++
 .../file_with-comments_1.5.json.bin           |  32 ++++
 .../file_with-comments_1.5.xml.bin            |  26 +++
 .../file_with-extras_1.2.json.bin             |  32 ++++
 .../requirements/file_with-extras_1.2.xml.bin |  26 +++
 .../file_with-extras_1.3.json.bin             |  32 ++++
 .../requirements/file_with-extras_1.3.xml.bin |  26 +++
 .../file_with-extras_1.4.json.bin             |  32 ++++
 .../requirements/file_with-extras_1.4.xml.bin |  26 +++
 .../file_with-extras_1.5.json.bin             |  32 ++++
 .../requirements/file_with-extras_1.5.xml.bin |  26 +++
 .../file_with-hashes_1.2.json.bin             |  32 ++++
 .../requirements/file_with-hashes_1.2.xml.bin |  26 +++
 .../file_with-hashes_1.3.json.bin             |  32 ++++
 .../requirements/file_with-hashes_1.3.xml.bin |  26 +++
 .../file_with-hashes_1.4.json.bin             |  32 ++++
 .../requirements/file_with-hashes_1.4.xml.bin |  26 +++
 .../file_with-hashes_1.5.json.bin             |  32 ++++
 .../requirements/file_with-hashes_1.5.xml.bin |  26 +++
 .../requirements/file_with-urls_1.2.json.bin  |  32 ++++
 .../requirements/file_with-urls_1.2.xml.bin   |  26 +++
 .../requirements/file_with-urls_1.3.json.bin  |  32 ++++
 .../requirements/file_with-urls_1.3.xml.bin   |  26 +++
 .../requirements/file_with-urls_1.4.json.bin  |  32 ++++
 .../requirements/file_with-urls_1.4.xml.bin   |  26 +++
 .../requirements/file_with-urls_1.5.json.bin  |  32 ++++
 .../requirements/file_with-urls_1.5.xml.bin   |  26 +++
 .../file_without-pinned-versions_1.2.json.bin |  32 ++++
 .../file_without-pinned-versions_1.2.xml.bin  |  26 +++
 .../file_without-pinned-versions_1.3.json.bin |  32 ++++
 .../file_without-pinned-versions_1.3.xml.bin  |  26 +++
 .../file_without-pinned-versions_1.4.json.bin |  32 ++++
 .../file_without-pinned-versions_1.4.xml.bin  |  26 +++
 .../file_without-pinned-versions_1.5.json.bin |  32 ++++
 .../file_without-pinned-versions_1.5.xml.bin  |  26 +++
 141 files changed, 3695 insertions(+), 955 deletions(-)
 create mode 100644 cyclonedx_py/_internal/utils/pyproject.py

diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index c3a25268..372b2f62 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -375,7 +375,7 @@ def __extrefs4poetryproj(self, po_cfg: 'NameDict') -> Generator['ExternalReferen
         ]:
             try:
                 yield ExternalReference(
-                    comment=f'project metadata: {ers}',
+                    comment=f'from poetry: {ers}',
                     type=ert,
                     url=XsUri(str(po_cfg[ers])))
             except (KeyError, InvalidUriException):  # pragma: nocover
@@ -383,7 +383,7 @@ def __extrefs4poetryproj(self, po_cfg: 'NameDict') -> Generator['ExternalReferen
         for ul, ut in po_cfg.get('urls', {}).items():
             try:
                 yield ExternalReference(
-                    comment=f'package url: {ul}',
+                    comment=f'from poetry url: {ul}',
                     type=url_label_to_ert(ul),
                     url=XsUri(str(ut)))
             except InvalidUriException:  # pragma: nocover
diff --git a/cyclonedx_py/_internal/utils/cdx.py b/cyclonedx_py/_internal/utils/cdx.py
index 35051b6a..e92692d7 100644
--- a/cyclonedx_py/_internal/utils/cdx.py
+++ b/cyclonedx_py/_internal/utils/cdx.py
@@ -89,6 +89,7 @@ def licenses_fixup(licenses: Iterable['License']) -> Iterable['License']:
     'issues': ExternalReferenceType.ISSUE_TRACKER,
     'bugreports': ExternalReferenceType.ISSUE_TRACKER,
     'tracker': ExternalReferenceType.ISSUE_TRACKER,
+    'home': ExternalReferenceType.WEBSITE,
     'homepage': ExternalReferenceType.WEBSITE,
     'download': ExternalReferenceType.DISTRIBUTION,
     'documentation': ExternalReferenceType.DOCUMENTATION,
diff --git a/cyclonedx_py/_internal/utils/packaging.py b/cyclonedx_py/_internal/utils/packaging.py
index 075b6841..558d9ddb 100644
--- a/cyclonedx_py/_internal/utils/packaging.py
+++ b/cyclonedx_py/_internal/utils/packaging.py
@@ -51,31 +51,27 @@ def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReferenc
 
     from .cdx import url_label_to_ert
 
-    if 'Home-page' in metadata:
+    for meta_key, extref_typet in (
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#home-page
-        try:
-            yield ExternalReference(
-                type=ExternalReferenceType.WEBSITE,
-                url=XsUri(metadata['Home-page']),
-                comment='Home-page')
-        except InvalidUriException:
-            pass
-    if 'Download-URL' in metadata:
+        ('Home-page', ExternalReferenceType.WEBSITE),
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#download-url
-        try:
-            yield ExternalReference(
-                type=ExternalReferenceType.DISTRIBUTION,
-                url=XsUri(metadata['Download-URL']),
-                comment='Download-URL')
-        except InvalidUriException:
-            pass
+        ('Download-URL', ExternalReferenceType.DISTRIBUTION),
+    ):
+        if meta_key in metadata:
+            try:
+                yield ExternalReference(
+                    comment=f'from packaging metadata: {meta_key}',
+                    type=extref_typet,
+                    url=XsUri(metadata[meta_key]))
+            except InvalidUriException:
+                pass
     for label_url in metadata.get_all('Project-URL', ()):
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#project-url-multiple-use
         label, url = label_url.split(',', maxsplit=1)
         try:
             yield ExternalReference(
+                comment=f'from packaging metadata Project-URL: {label}',
                 type=url_label_to_ert(label),
-                url=XsUri(url.strip()),
-                comment=f'Project-URL: {label}')
+                url=XsUri(url.strip()))
         except InvalidUriException:
             pass
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index d7f3a008..c456896c 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -27,6 +27,7 @@
 
 if TYPE_CHECKING:
     from cyclonedx.factory.license import LicenseFactory
+    from cyclonedx.model import ExternalReference
     from cyclonedx.model.component import Component, ComponentType
     from cyclonedx.model.license import License
 
@@ -64,17 +65,35 @@ def pyproject2component(pyproject: Dict[str, Any], *,
     from .cdx import licenses_fixup
 
     project = pyproject['project']
+    dynamic = project.get('dynamic', ())
     return Component(
         type=type,
         name=project['name'],
-        version=project.get('version', None),
-        description=project.get('description', None),
+        version=project.get('version', None) if 'version' not in dynamic else None,
+        description=project.get('description', None) if 'description' not in dynamic else None,
         licenses=licenses_fixup(pyproject2licenses(project, LicenseFactory())),
+        external_references=_project2extrefs(project),
         # TODO add more properties according to spec
-        # extRefs with .cdx.url_label_to_ert()
     )
 
 
+def _project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
+    from cyclonedx.exception.model import InvalidUriException
+    from cyclonedx.model import ExternalReference, XsUri
+
+    from .cdx import url_label_to_ert
+
+    # see https://packaging.python.org/en/latest/specifications/pyproject-toml/#urls
+    for label, url in project.get('urls', {}).items():
+        try:
+            yield ExternalReference(
+                comment=f'from pyproject urls: {label}',
+                type=url_label_to_ert(label),
+                url=XsUri(str(url)))
+        except InvalidUriException:
+            pass
+
+
 def pyproject_load(pyproject_file: str) -> Dict[str, Any]:
     from .toml import toml_loads
     try:
diff --git a/cyclonedx_py/_internal/utils/pyproject.py b/cyclonedx_py/_internal/utils/pyproject.py
new file mode 100644
index 00000000..317af77f
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/pyproject.py
@@ -0,0 +1,9 @@
+# use pyproject from pep621
+# use pyproject from poetry implementation
+
+# usage: environment may use also th pyprojevt implementation ...
+# poetry uses only poetry implementation
+# all othther use pep621
+
+
+# TODO ^^^^
diff --git a/tests/_data/infiles/environment/no-deps/pyproject.toml b/tests/_data/infiles/environment/no-deps/pyproject.toml
index 501d43c7..e0dfd501 100644
--- a/tests/_data/infiles/environment/no-deps/pyproject.toml
+++ b/tests/_data/infiles/environment/no-deps/pyproject.toml
@@ -7,14 +7,6 @@ license = {text="Apache-2.0 OR MIT"}
 readme = "README.md"
 requires-python = ">=3.8"
 
-[project.urls]
-homepage = "https://oss.acme.org/my-project/"
-repository = "https://oss.acme.org/my-project.git"
-documentation = "https://oss.acme.org/my-project/docs/"
-"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
-"Funding" = "https://oss.acme.org/my-project/funding/"
-"Change log" = "https://oss.acme.org/my-project/changelog/"
-
 #  dynamic = [] # TODO
 
 authors = ["Your Name <you@example.com>", "My Name"]
@@ -39,3 +31,10 @@ classifiers = [
 # gui-scripts = {} # TODO
 # scripts = {} # TODO
 
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
diff --git a/tests/_data/infiles/environment/with-extras/pyproject.toml b/tests/_data/infiles/environment/with-extras/pyproject.toml
index 501d43c7..1420454b 100644
--- a/tests/_data/infiles/environment/with-extras/pyproject.toml
+++ b/tests/_data/infiles/environment/with-extras/pyproject.toml
@@ -1,41 +1,5 @@
 [project]
 # https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
-name = "no-deps"
+name = "with-extras"
 version = "0.1.0"
-description = "packages with all meta, but no deps"
-license = {text="Apache-2.0 OR MIT"}
-readme = "README.md"
-requires-python = ">=3.8"
-
-[project.urls]
-homepage = "https://oss.acme.org/my-project/"
-repository = "https://oss.acme.org/my-project.git"
-documentation = "https://oss.acme.org/my-project/docs/"
-"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
-"Funding" = "https://oss.acme.org/my-project/funding/"
-"Change log" = "https://oss.acme.org/my-project/changelog/"
-
-#  dynamic = [] # TODO
-
-authors = ["Your Name <you@example.com>", "My Name"]
-maintainers = [
-  "John Smith <johnsmith@example.org>",
-  "Jane Smith <janesmith@example.org>",
-]
-
-keywords = ["packaging", "pipenv", "test"]
-classifiers = [
-  "License :: OSI Approved :: Apache Software License",
-  "License :: OSI Approved :: MIT License",
-  "Classifier: Development Status :: 4 - Beta",
-  "Intended Audience :: Developers"
-]
-
-# dependencies = [] # TODO
-# optional-dependencies = [] # TODO
-
-# entry-point = {} # TODO
-
-# gui-scripts = {} # TODO
-# scripts = {} # TODO
-
+description = "depenndencies with extras"
diff --git a/tests/_data/infiles/pipenv/no-deps/pyproject.toml b/tests/_data/infiles/pipenv/no-deps/pyproject.toml
index 501d43c7..e0dfd501 100644
--- a/tests/_data/infiles/pipenv/no-deps/pyproject.toml
+++ b/tests/_data/infiles/pipenv/no-deps/pyproject.toml
@@ -7,14 +7,6 @@ license = {text="Apache-2.0 OR MIT"}
 readme = "README.md"
 requires-python = ">=3.8"
 
-[project.urls]
-homepage = "https://oss.acme.org/my-project/"
-repository = "https://oss.acme.org/my-project.git"
-documentation = "https://oss.acme.org/my-project/docs/"
-"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
-"Funding" = "https://oss.acme.org/my-project/funding/"
-"Change log" = "https://oss.acme.org/my-project/changelog/"
-
 #  dynamic = [] # TODO
 
 authors = ["Your Name <you@example.com>", "My Name"]
@@ -39,3 +31,10 @@ classifiers = [
 # gui-scripts = {} # TODO
 # scripts = {} # TODO
 
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
diff --git a/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
index a24063d8..4e07a1c4 100644
--- a/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
+++ b/tests/_data/infiles/poetry/no-deps/pyproject-proto.toml
@@ -19,10 +19,12 @@ classifiers = [
   "Classifier: Development Status :: 4 - Beta",
   "Intended Audience :: Developers"
 ]
+
 [tool.poetry.urls]
 "Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
 "Funding" = "https://oss.acme.org/my-project/funding/"
 "Change log" = "https://oss.acme.org/my-project/changelog/"
+
 [tool.poetry.dependencies]
 python = "*"
 
diff --git a/tests/_data/infiles/requirements/pyproject.toml b/tests/_data/infiles/requirements/pyproject.toml
index ca213c81..0a190a8b 100644
--- a/tests/_data/infiles/requirements/pyproject.toml
+++ b/tests/_data/infiles/requirements/pyproject.toml
@@ -7,14 +7,6 @@ license = {text="Apache-2.0 OR MIT"}
 readme = "README.md"
 requires-python = ">=3.7"
 
-[project.urls]
-homepage = "https://oss.acme.org/my-project/"
-repository = "https://oss.acme.org/my-project.git"
-documentation = "https://oss.acme.org/my-project/docs/"
-"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
-"Funding" = "https://oss.acme.org/my-project/funding/"
-"Change log" = "https://oss.acme.org/my-project/changelog/"
-
 #  dynamic = [] # TODO
 
 authors = ["Your Name <you@example.com>", "My Name"]
@@ -39,3 +31,10 @@ classifiers = [
 # gui-scripts = {} # TODO
 # scripts = {} # TODO
 
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin
index 401d6522..4e08d28a 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.1.xml.bin
@@ -14,7 +14,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin
index 92a0daea..d1c2f622 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.2.json.bin
@@ -5,7 +5,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin
index 805ee934..7a3ad29a 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.2.xml.bin
@@ -33,7 +33,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
index e351e0f6..c9e9b4e6 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.3.json.bin
@@ -5,7 +5,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
index 74b98501..581ab83a 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.3.xml.bin
@@ -36,7 +36,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
index bcf8d158..1515817b 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.4.json.bin
@@ -5,7 +5,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
index 271da970..c5f314ff 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.4.xml.bin
@@ -63,7 +63,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin b/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
index 8a80a1fd..01f7a341 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.5.json.bin
@@ -5,7 +5,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
diff --git a/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin b/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
index 607ea275..4ddf82f6 100644
--- a/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_editable-self_1.5.xml.bin
@@ -63,7 +63,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin
index b1e74fb9..6de193b1 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.2.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin
index 1aa0d581..a982f421 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <dependencies>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
index 51944f0f..4922946d 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.3.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
index 6b024c83..f70c1e34 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
index 00aae6df..354ca1e5 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.4.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
index fdc1f9a7..3a1fc66d 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin b/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
index 788abb29..e246c19d 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.5.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin b/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
index 05b343fe..bf68b2e3 100644
--- a/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_no-deps_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin
index df180f04..8e7c5574 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.1.xml.bin
@@ -9,15 +9,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://arrow.readthedocs.io</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/arrow-py/arrow/issues</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/arrow-py/arrow</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
       </externalReferences>
     </component>
@@ -34,27 +34,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://www.attrs.org/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-attrs/attrs/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-attrs/attrs</url>
-          <comment>Project-URL: Source Code</comment>
+          <comment>from packaging metadata Project-URL: Source Code</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/hynek</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="other">
           <url>https://www.attrs.org/en/stable/changelog.html</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -71,7 +71,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/bastikr/boolean.py</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -88,23 +88,23 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -124,11 +124,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.python.org/pypi/defusedxml</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/tiran/defusedxml</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -145,7 +145,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/ypcrts/fqdn</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -157,15 +157,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/kjd/idna/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -177,11 +177,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://importlib-resources.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/importlib_resources</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -201,19 +201,19 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/bolsote/isoduration/issues</url>
-          <comment>Project-URL: Bug Reports</comment>
+          <comment>from packaging metadata Project-URL: Bug Reports</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -230,7 +230,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/stefankoegl/python-json-pointer</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -247,31 +247,31 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://python-jsonschema.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -288,27 +288,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://jsonschema-specifications.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -325,7 +325,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/nexB/license-expression</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -342,11 +342,11 @@
       <externalReferences>
         <reference type="other">
           <url>https://github.com/lxml/lxml</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://lxml.de/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -363,7 +363,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/package-url/packageurl-python</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -380,7 +380,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/graingert/pkgutil-resolve-name</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -397,15 +397,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/madpah/serializable/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -422,15 +422,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://dateutil.readthedocs.io/en/stable/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -447,27 +447,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://referencing.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/referencing/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -487,7 +487,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/naimetti/rfc3339-validator</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -507,11 +507,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/dgerber/rfc3987</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>http://pypi.python.org/pypi/rfc3987</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -528,27 +528,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://rpds.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/crate-py/rpds/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -565,7 +565,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -582,7 +582,7 @@
       <externalReferences>
         <reference type="website">
           <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -599,23 +599,23 @@
       <externalReferences>
         <reference type="chat">
           <url>https://gitter.im/python/typing</url>
-          <comment>Project-URL: Chat</comment>
+          <comment>from packaging metadata Project-URL: Chat</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python/typeshed/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
-          <comment>Project-URL: Changes</comment>
+          <comment>from packaging metadata Project-URL: Changes</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/python/typeshed</url>
-          <comment>Project-URL: GitHub</comment>
+          <comment>from packaging metadata Project-URL: GitHub</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/typeshed</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -635,7 +635,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://gitlab.linss.com/open-source/python/uri-template</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -652,11 +652,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://webcolors.readthedocs.io</url>
-          <comment>Project-URL: documentation</comment>
+          <comment>from packaging metadata Project-URL: documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/ubernostrum/webcolors</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -673,7 +673,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/jaraco/zipp</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
index 6deb0de9..c719b39f 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
@@ -5,17 +5,17 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://arrow.readthedocs.io"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/arrow-py/arrow/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/arrow-py/arrow"
         }
@@ -30,32 +30,32 @@
       "description": "Classes Without Boilerplate",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://www.attrs.org/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python-attrs/attrs/issues"
         },
         {
-          "comment": "Project-URL: Source Code",
+          "comment": "from packaging metadata Project-URL: Source Code",
           "type": "other",
           "url": "https://github.com/python-attrs/attrs"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/hynek"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://www.attrs.org/en/stable/changelog.html"
         }
@@ -77,7 +77,7 @@
       "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bastikr/boolean.py"
         }
@@ -99,27 +99,27 @@
       "description": "Python library for CycloneDX",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://cyclonedx-python-library.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
         }
@@ -141,12 +141,12 @@
       "description": "XML bomb protection for Python stdlib modules",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://pypi.python.org/pypi/defusedxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/tiran/defusedxml"
         }
@@ -173,7 +173,7 @@
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/ypcrts/fqdn"
         }
@@ -195,17 +195,17 @@
       "description": "Internationalized Domain Names in Applications (IDNA)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/kjd/idna/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/kjd/idna"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
         }
@@ -220,12 +220,12 @@
       "description": "Read resources from Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://importlib-resources.readthedocs.io/"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/importlib_resources"
         }
@@ -240,22 +240,22 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Reports",
+          "comment": "from packaging metadata Project-URL: Bug Reports",
           "type": "issue-tracker",
           "url": "https://github.com/bolsote/isoduration/issues"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/bolsote/isoduration"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bolsote/isoduration"
         }
@@ -282,7 +282,7 @@
       "description": "Identify specific nodes in a JSON document (RFC 6901) ",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/stefankoegl/python-json-pointer"
         }
@@ -304,37 +304,37 @@
       "description": "An implementation of JSON Schema validation for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://python-jsonschema.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema"
         }
@@ -356,32 +356,32 @@
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://jsonschema-specifications.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         }
@@ -403,7 +403,7 @@
       "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/nexB/license-expression"
         }
@@ -425,12 +425,12 @@
       "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/lxml/lxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://lxml.de/"
         }
@@ -452,7 +452,7 @@
       "description": "A purl aka. Package URL parser and builder",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/package-url/packageurl-python"
         }
@@ -474,7 +474,7 @@
       "description": "Resolve a name to an object.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/graingert/pkgutil-resolve-name"
         }
@@ -496,17 +496,17 @@
       "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/madpah/serializable/issues"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/madpah/serializable"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/madpah/serializable"
         }
@@ -528,17 +528,17 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://dateutil.readthedocs.io/en/stable/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/dateutil/dateutil"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/dateutil/dateutil"
         }
@@ -560,32 +560,32 @@
       "description": "JSON Referencing + Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://referencing.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/referencing/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/referencing"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/referencing"
         }
@@ -607,7 +607,7 @@
       "description": "A pure python RFC3339 validator",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/naimetti/rfc3339-validator"
         }
@@ -634,12 +634,12 @@
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://github.com/dgerber/rfc3987"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://pypi.python.org/pypi/rfc3987"
         }
@@ -666,32 +666,32 @@
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://rpds.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/crate-py/rpds/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/crate-py/rpds"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/crate-py/rpds"
         }
@@ -713,7 +713,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -735,7 +735,7 @@
       "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://www.grantjenks.com/docs/sortedcontainers/"
         }
@@ -757,27 +757,27 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
-          "comment": "Project-URL: Chat",
+          "comment": "from packaging metadata Project-URL: Chat",
           "type": "chat",
           "url": "https://gitter.im/python/typing"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python/typeshed/issues"
         },
         {
-          "comment": "Project-URL: Changes",
+          "comment": "from packaging metadata Project-URL: Changes",
           "type": "other",
           "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
         },
         {
-          "comment": "Project-URL: GitHub",
+          "comment": "from packaging metadata Project-URL: GitHub",
           "type": "vcs",
           "url": "https://github.com/python/typeshed"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/typeshed"
         }
@@ -799,7 +799,7 @@
       "description": "RFC 6570 URI Template Processor",
       "externalReferences": [
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://gitlab.linss.com/open-source/python/uri-template"
         }
@@ -826,12 +826,12 @@
       "description": "A library for working with the color formats defined by HTML and CSS.",
       "externalReferences": [
         {
-          "comment": "Project-URL: documentation",
+          "comment": "from packaging metadata Project-URL: documentation",
           "type": "documentation",
           "url": "https://webcolors.readthedocs.io"
         },
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://github.com/ubernostrum/webcolors"
         }
@@ -853,7 +853,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/jaraco/zipp"
         }
@@ -1019,13 +1019,8 @@
   "metadata": {
     "component": {
       "bom-ref": "root-component",
-      "description": "packages with all meta, but no deps",
-      "licenses": [
-        {
-          "expression": "Apache-2.0 OR MIT"
-        }
-      ],
-      "name": "no-deps",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
       "type": "application",
       "version": "0.1.0"
     },
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
index ffb0794b..212270c7 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
@@ -14,12 +14,9 @@
       </tool>
     </tools>
     <component type="application" bom-ref="root-component">
-      <name>no-deps</name>
+      <name>with-extras</name>
       <version>0.1.0</version>
-      <description>packages with all meta, but no deps</description>
-      <licenses>
-        <expression>Apache-2.0 OR MIT</expression>
-      </licenses>
+      <description>depenndencies with extras</description>
     </component>
   </metadata>
   <components>
@@ -31,15 +28,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://arrow.readthedocs.io</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/arrow-py/arrow/issues</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/arrow-py/arrow</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
       </externalReferences>
     </component>
@@ -56,27 +53,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://www.attrs.org/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-attrs/attrs/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-attrs/attrs</url>
-          <comment>Project-URL: Source Code</comment>
+          <comment>from packaging metadata Project-URL: Source Code</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/hynek</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="other">
           <url>https://www.attrs.org/en/stable/changelog.html</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -93,7 +90,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/bastikr/boolean.py</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -110,23 +107,23 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -146,11 +143,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.python.org/pypi/defusedxml</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/tiran/defusedxml</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -167,7 +164,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/ypcrts/fqdn</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -179,15 +176,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/kjd/idna/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -199,11 +196,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://importlib-resources.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/importlib_resources</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -223,19 +220,19 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/bolsote/isoduration/issues</url>
-          <comment>Project-URL: Bug Reports</comment>
+          <comment>from packaging metadata Project-URL: Bug Reports</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -252,7 +249,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/stefankoegl/python-json-pointer</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -269,31 +266,31 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://python-jsonschema.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -310,27 +307,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://jsonschema-specifications.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -347,7 +344,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/nexB/license-expression</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -364,11 +361,11 @@
       <externalReferences>
         <reference type="other">
           <url>https://github.com/lxml/lxml</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://lxml.de/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -385,7 +382,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/package-url/packageurl-python</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -402,7 +399,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/graingert/pkgutil-resolve-name</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -419,15 +416,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/madpah/serializable/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -444,15 +441,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://dateutil.readthedocs.io/en/stable/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -469,27 +466,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://referencing.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/referencing/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -509,7 +506,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/naimetti/rfc3339-validator</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -529,11 +526,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/dgerber/rfc3987</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>http://pypi.python.org/pypi/rfc3987</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -550,27 +547,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://rpds.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/crate-py/rpds/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -587,7 +584,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -604,7 +601,7 @@
       <externalReferences>
         <reference type="website">
           <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -621,23 +618,23 @@
       <externalReferences>
         <reference type="chat">
           <url>https://gitter.im/python/typing</url>
-          <comment>Project-URL: Chat</comment>
+          <comment>from packaging metadata Project-URL: Chat</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python/typeshed/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
-          <comment>Project-URL: Changes</comment>
+          <comment>from packaging metadata Project-URL: Changes</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/python/typeshed</url>
-          <comment>Project-URL: GitHub</comment>
+          <comment>from packaging metadata Project-URL: GitHub</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/typeshed</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -657,7 +654,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://gitlab.linss.com/open-source/python/uri-template</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -674,11 +671,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://webcolors.readthedocs.io</url>
-          <comment>Project-URL: documentation</comment>
+          <comment>from packaging metadata Project-URL: documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/ubernostrum/webcolors</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -695,7 +692,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/jaraco/zipp</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
index d1dc3e38..c2b94778 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
@@ -5,17 +5,17 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://arrow.readthedocs.io"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/arrow-py/arrow/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/arrow-py/arrow"
         }
@@ -30,32 +30,32 @@
       "description": "Classes Without Boilerplate",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://www.attrs.org/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python-attrs/attrs/issues"
         },
         {
-          "comment": "Project-URL: Source Code",
+          "comment": "from packaging metadata Project-URL: Source Code",
           "type": "other",
           "url": "https://github.com/python-attrs/attrs"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/hynek"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://www.attrs.org/en/stable/changelog.html"
         }
@@ -77,7 +77,7 @@
       "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bastikr/boolean.py"
         }
@@ -99,27 +99,27 @@
       "description": "Python library for CycloneDX",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://cyclonedx-python-library.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
         }
@@ -141,12 +141,12 @@
       "description": "XML bomb protection for Python stdlib modules",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://pypi.python.org/pypi/defusedxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/tiran/defusedxml"
         }
@@ -173,7 +173,7 @@
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/ypcrts/fqdn"
         }
@@ -195,17 +195,17 @@
       "description": "Internationalized Domain Names in Applications (IDNA)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/kjd/idna/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/kjd/idna"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
         }
@@ -220,12 +220,12 @@
       "description": "Read resources from Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://importlib-resources.readthedocs.io/"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/importlib_resources"
         }
@@ -240,22 +240,22 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Reports",
+          "comment": "from packaging metadata Project-URL: Bug Reports",
           "type": "issue-tracker",
           "url": "https://github.com/bolsote/isoduration/issues"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/bolsote/isoduration"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bolsote/isoduration"
         }
@@ -282,7 +282,7 @@
       "description": "Identify specific nodes in a JSON document (RFC 6901) ",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/stefankoegl/python-json-pointer"
         }
@@ -304,37 +304,37 @@
       "description": "An implementation of JSON Schema validation for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://python-jsonschema.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema"
         }
@@ -356,32 +356,32 @@
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://jsonschema-specifications.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         }
@@ -403,7 +403,7 @@
       "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/nexB/license-expression"
         }
@@ -425,12 +425,12 @@
       "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/lxml/lxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://lxml.de/"
         }
@@ -452,7 +452,7 @@
       "description": "A purl aka. Package URL parser and builder",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/package-url/packageurl-python"
         }
@@ -474,7 +474,7 @@
       "description": "Resolve a name to an object.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/graingert/pkgutil-resolve-name"
         }
@@ -496,17 +496,17 @@
       "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/madpah/serializable/issues"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/madpah/serializable"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/madpah/serializable"
         }
@@ -528,17 +528,17 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://dateutil.readthedocs.io/en/stable/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/dateutil/dateutil"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/dateutil/dateutil"
         }
@@ -560,32 +560,32 @@
       "description": "JSON Referencing + Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://referencing.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/referencing/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/referencing"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/referencing"
         }
@@ -607,7 +607,7 @@
       "description": "A pure python RFC3339 validator",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/naimetti/rfc3339-validator"
         }
@@ -634,12 +634,12 @@
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://github.com/dgerber/rfc3987"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://pypi.python.org/pypi/rfc3987"
         }
@@ -666,32 +666,32 @@
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://rpds.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/crate-py/rpds/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/crate-py/rpds"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/crate-py/rpds"
         }
@@ -713,7 +713,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -735,7 +735,7 @@
       "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://www.grantjenks.com/docs/sortedcontainers/"
         }
@@ -757,27 +757,27 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
-          "comment": "Project-URL: Chat",
+          "comment": "from packaging metadata Project-URL: Chat",
           "type": "chat",
           "url": "https://gitter.im/python/typing"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python/typeshed/issues"
         },
         {
-          "comment": "Project-URL: Changes",
+          "comment": "from packaging metadata Project-URL: Changes",
           "type": "other",
           "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
         },
         {
-          "comment": "Project-URL: GitHub",
+          "comment": "from packaging metadata Project-URL: GitHub",
           "type": "vcs",
           "url": "https://github.com/python/typeshed"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/typeshed"
         }
@@ -799,7 +799,7 @@
       "description": "RFC 6570 URI Template Processor",
       "externalReferences": [
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://gitlab.linss.com/open-source/python/uri-template"
         }
@@ -826,12 +826,12 @@
       "description": "A library for working with the color formats defined by HTML and CSS.",
       "externalReferences": [
         {
-          "comment": "Project-URL: documentation",
+          "comment": "from packaging metadata Project-URL: documentation",
           "type": "documentation",
           "url": "https://webcolors.readthedocs.io"
         },
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://github.com/ubernostrum/webcolors"
         }
@@ -853,7 +853,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/jaraco/zipp"
         }
@@ -1019,13 +1019,8 @@
   "metadata": {
     "component": {
       "bom-ref": "root-component",
-      "description": "packages with all meta, but no deps",
-      "licenses": [
-        {
-          "expression": "Apache-2.0 OR MIT"
-        }
-      ],
-      "name": "no-deps",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
       "type": "application",
       "version": "0.1.0"
     },
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
index 52267114..3df7b5ee 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
@@ -14,12 +14,9 @@
       </tool>
     </tools>
     <component type="application" bom-ref="root-component">
-      <name>no-deps</name>
+      <name>with-extras</name>
       <version>0.1.0</version>
-      <description>packages with all meta, but no deps</description>
-      <licenses>
-        <expression>Apache-2.0 OR MIT</expression>
-      </licenses>
+      <description>depenndencies with extras</description>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
@@ -34,15 +31,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://arrow.readthedocs.io</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/arrow-py/arrow/issues</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/arrow-py/arrow</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
       </externalReferences>
     </component>
@@ -59,27 +56,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://www.attrs.org/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-attrs/attrs/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-attrs/attrs</url>
-          <comment>Project-URL: Source Code</comment>
+          <comment>from packaging metadata Project-URL: Source Code</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/hynek</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="other">
           <url>https://www.attrs.org/en/stable/changelog.html</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -96,7 +93,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/bastikr/boolean.py</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -113,23 +110,23 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -149,11 +146,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.python.org/pypi/defusedxml</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/tiran/defusedxml</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -170,7 +167,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/ypcrts/fqdn</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -182,15 +179,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/kjd/idna/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -202,11 +199,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://importlib-resources.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/importlib_resources</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -226,19 +223,19 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/bolsote/isoduration/issues</url>
-          <comment>Project-URL: Bug Reports</comment>
+          <comment>from packaging metadata Project-URL: Bug Reports</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -255,7 +252,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/stefankoegl/python-json-pointer</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -272,31 +269,31 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://python-jsonschema.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -313,27 +310,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://jsonschema-specifications.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -350,7 +347,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/nexB/license-expression</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -367,11 +364,11 @@
       <externalReferences>
         <reference type="other">
           <url>https://github.com/lxml/lxml</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://lxml.de/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -388,7 +385,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/package-url/packageurl-python</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -405,7 +402,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/graingert/pkgutil-resolve-name</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -422,15 +419,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/madpah/serializable/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -447,15 +444,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://dateutil.readthedocs.io/en/stable/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -472,27 +469,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://referencing.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/referencing/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -512,7 +509,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/naimetti/rfc3339-validator</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -532,11 +529,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/dgerber/rfc3987</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>http://pypi.python.org/pypi/rfc3987</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -553,27 +550,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://rpds.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/crate-py/rpds/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -590,7 +587,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -607,7 +604,7 @@
       <externalReferences>
         <reference type="website">
           <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -624,23 +621,23 @@
       <externalReferences>
         <reference type="chat">
           <url>https://gitter.im/python/typing</url>
-          <comment>Project-URL: Chat</comment>
+          <comment>from packaging metadata Project-URL: Chat</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python/typeshed/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
-          <comment>Project-URL: Changes</comment>
+          <comment>from packaging metadata Project-URL: Changes</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/python/typeshed</url>
-          <comment>Project-URL: GitHub</comment>
+          <comment>from packaging metadata Project-URL: GitHub</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/typeshed</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -660,7 +657,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://gitlab.linss.com/open-source/python/uri-template</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -677,11 +674,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://webcolors.readthedocs.io</url>
-          <comment>Project-URL: documentation</comment>
+          <comment>from packaging metadata Project-URL: documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/ubernostrum/webcolors</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -698,7 +695,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/jaraco/zipp</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
index 7981de21..90a65cf5 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
@@ -5,17 +5,17 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://arrow.readthedocs.io"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/arrow-py/arrow/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/arrow-py/arrow"
         }
@@ -30,32 +30,32 @@
       "description": "Classes Without Boilerplate",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://www.attrs.org/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python-attrs/attrs/issues"
         },
         {
-          "comment": "Project-URL: Source Code",
+          "comment": "from packaging metadata Project-URL: Source Code",
           "type": "other",
           "url": "https://github.com/python-attrs/attrs"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/hynek"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://www.attrs.org/en/stable/changelog.html"
         }
@@ -77,7 +77,7 @@
       "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bastikr/boolean.py"
         }
@@ -99,27 +99,27 @@
       "description": "Python library for CycloneDX",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://cyclonedx-python-library.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
         }
@@ -141,12 +141,12 @@
       "description": "XML bomb protection for Python stdlib modules",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://pypi.python.org/pypi/defusedxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/tiran/defusedxml"
         }
@@ -173,7 +173,7 @@
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/ypcrts/fqdn"
         }
@@ -195,17 +195,17 @@
       "description": "Internationalized Domain Names in Applications (IDNA)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/kjd/idna/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/kjd/idna"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
         }
@@ -220,12 +220,12 @@
       "description": "Read resources from Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://importlib-resources.readthedocs.io/"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/importlib_resources"
         }
@@ -240,22 +240,22 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Reports",
+          "comment": "from packaging metadata Project-URL: Bug Reports",
           "type": "issue-tracker",
           "url": "https://github.com/bolsote/isoduration/issues"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/bolsote/isoduration"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bolsote/isoduration"
         }
@@ -282,7 +282,7 @@
       "description": "Identify specific nodes in a JSON document (RFC 6901) ",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/stefankoegl/python-json-pointer"
         }
@@ -304,37 +304,37 @@
       "description": "An implementation of JSON Schema validation for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://python-jsonschema.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema"
         }
@@ -356,32 +356,32 @@
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://jsonschema-specifications.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         }
@@ -403,7 +403,7 @@
       "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/nexB/license-expression"
         }
@@ -425,12 +425,12 @@
       "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/lxml/lxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://lxml.de/"
         }
@@ -452,7 +452,7 @@
       "description": "A purl aka. Package URL parser and builder",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/package-url/packageurl-python"
         }
@@ -474,7 +474,7 @@
       "description": "Resolve a name to an object.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/graingert/pkgutil-resolve-name"
         }
@@ -496,17 +496,17 @@
       "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/madpah/serializable/issues"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/madpah/serializable"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/madpah/serializable"
         }
@@ -528,17 +528,17 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://dateutil.readthedocs.io/en/stable/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/dateutil/dateutil"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/dateutil/dateutil"
         }
@@ -560,32 +560,32 @@
       "description": "JSON Referencing + Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://referencing.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/referencing/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/referencing"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/referencing"
         }
@@ -607,7 +607,7 @@
       "description": "A pure python RFC3339 validator",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/naimetti/rfc3339-validator"
         }
@@ -634,12 +634,12 @@
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://github.com/dgerber/rfc3987"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://pypi.python.org/pypi/rfc3987"
         }
@@ -666,32 +666,32 @@
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://rpds.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/crate-py/rpds/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/crate-py/rpds"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/crate-py/rpds"
         }
@@ -713,7 +713,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -735,7 +735,7 @@
       "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://www.grantjenks.com/docs/sortedcontainers/"
         }
@@ -757,27 +757,27 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
-          "comment": "Project-URL: Chat",
+          "comment": "from packaging metadata Project-URL: Chat",
           "type": "chat",
           "url": "https://gitter.im/python/typing"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python/typeshed/issues"
         },
         {
-          "comment": "Project-URL: Changes",
+          "comment": "from packaging metadata Project-URL: Changes",
           "type": "release-notes",
           "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
         },
         {
-          "comment": "Project-URL: GitHub",
+          "comment": "from packaging metadata Project-URL: GitHub",
           "type": "vcs",
           "url": "https://github.com/python/typeshed"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/typeshed"
         }
@@ -799,7 +799,7 @@
       "description": "RFC 6570 URI Template Processor",
       "externalReferences": [
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://gitlab.linss.com/open-source/python/uri-template"
         }
@@ -826,12 +826,12 @@
       "description": "A library for working with the color formats defined by HTML and CSS.",
       "externalReferences": [
         {
-          "comment": "Project-URL: documentation",
+          "comment": "from packaging metadata Project-URL: documentation",
           "type": "documentation",
           "url": "https://webcolors.readthedocs.io"
         },
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://github.com/ubernostrum/webcolors"
         }
@@ -853,7 +853,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/jaraco/zipp"
         }
@@ -1019,13 +1019,8 @@
   "metadata": {
     "component": {
       "bom-ref": "root-component",
-      "description": "packages with all meta, but no deps",
-      "licenses": [
-        {
-          "expression": "Apache-2.0 OR MIT"
-        }
-      ],
-      "name": "no-deps",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
       "type": "application",
       "version": "0.1.0"
     },
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
index 7c3479cd..0813104f 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
@@ -41,12 +41,9 @@
       </tool>
     </tools>
     <component type="application" bom-ref="root-component">
-      <name>no-deps</name>
+      <name>with-extras</name>
       <version>0.1.0</version>
-      <description>packages with all meta, but no deps</description>
-      <licenses>
-        <expression>Apache-2.0 OR MIT</expression>
-      </licenses>
+      <description>depenndencies with extras</description>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
@@ -61,15 +58,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://arrow.readthedocs.io</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/arrow-py/arrow/issues</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/arrow-py/arrow</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
       </externalReferences>
     </component>
@@ -86,27 +83,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://www.attrs.org/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-attrs/attrs/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-attrs/attrs</url>
-          <comment>Project-URL: Source Code</comment>
+          <comment>from packaging metadata Project-URL: Source Code</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/hynek</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="release-notes">
           <url>https://www.attrs.org/en/stable/changelog.html</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -123,7 +120,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/bastikr/boolean.py</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -140,23 +137,23 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -176,11 +173,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.python.org/pypi/defusedxml</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/tiran/defusedxml</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -197,7 +194,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/ypcrts/fqdn</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -209,15 +206,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/kjd/idna/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -229,11 +226,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://importlib-resources.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/importlib_resources</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -253,19 +250,19 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/bolsote/isoduration/issues</url>
-          <comment>Project-URL: Bug Reports</comment>
+          <comment>from packaging metadata Project-URL: Bug Reports</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -282,7 +279,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/stefankoegl/python-json-pointer</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -299,31 +296,31 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://python-jsonschema.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -340,27 +337,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://jsonschema-specifications.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -377,7 +374,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/nexB/license-expression</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -394,11 +391,11 @@
       <externalReferences>
         <reference type="other">
           <url>https://github.com/lxml/lxml</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://lxml.de/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -415,7 +412,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/package-url/packageurl-python</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -432,7 +429,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/graingert/pkgutil-resolve-name</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -449,15 +446,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/madpah/serializable/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -474,15 +471,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://dateutil.readthedocs.io/en/stable/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -499,27 +496,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://referencing.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/referencing/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -539,7 +536,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/naimetti/rfc3339-validator</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -559,11 +556,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/dgerber/rfc3987</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>http://pypi.python.org/pypi/rfc3987</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -580,27 +577,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://rpds.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/crate-py/rpds/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -617,7 +614,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -634,7 +631,7 @@
       <externalReferences>
         <reference type="website">
           <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -651,23 +648,23 @@
       <externalReferences>
         <reference type="chat">
           <url>https://gitter.im/python/typing</url>
-          <comment>Project-URL: Chat</comment>
+          <comment>from packaging metadata Project-URL: Chat</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python/typeshed/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
-          <comment>Project-URL: Changes</comment>
+          <comment>from packaging metadata Project-URL: Changes</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/python/typeshed</url>
-          <comment>Project-URL: GitHub</comment>
+          <comment>from packaging metadata Project-URL: GitHub</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/typeshed</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -687,7 +684,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://gitlab.linss.com/open-source/python/uri-template</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -704,11 +701,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://webcolors.readthedocs.io</url>
-          <comment>Project-URL: documentation</comment>
+          <comment>from packaging metadata Project-URL: documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/ubernostrum/webcolors</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -725,7 +722,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/jaraco/zipp</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
index 80e13924..9477ed31 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
@@ -5,17 +5,17 @@
       "description": "Better dates & times for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://arrow.readthedocs.io"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/arrow-py/arrow/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/arrow-py/arrow"
         }
@@ -30,32 +30,32 @@
       "description": "Classes Without Boilerplate",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://www.attrs.org/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python-attrs/attrs/issues"
         },
         {
-          "comment": "Project-URL: Source Code",
+          "comment": "from packaging metadata Project-URL: Source Code",
           "type": "other",
           "url": "https://github.com/python-attrs/attrs"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/hynek"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://www.attrs.org/en/stable/changelog.html"
         }
@@ -77,7 +77,7 @@
       "description": "Define boolean algebras, create and parse boolean expressions and create custom boolean DSL.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bastikr/boolean.py"
         }
@@ -99,27 +99,27 @@
       "description": "Python library for CycloneDX",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://cyclonedx-python-library.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
         }
@@ -141,12 +141,12 @@
       "description": "XML bomb protection for Python stdlib modules",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://pypi.python.org/pypi/defusedxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/tiran/defusedxml"
         }
@@ -173,7 +173,7 @@
       "description": "Validates fully-qualified domain names against RFC 1123, so that they are acceptable to modern bowsers",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/ypcrts/fqdn"
         }
@@ -195,17 +195,17 @@
       "description": "Internationalized Domain Names in Applications (IDNA)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/kjd/idna/issues"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/kjd/idna"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://github.com/kjd/idna/blob/master/HISTORY.rst"
         }
@@ -220,12 +220,12 @@
       "description": "Read resources from Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://importlib-resources.readthedocs.io/"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/importlib_resources"
         }
@@ -240,22 +240,22 @@
       "description": "Operations with ISO 8601 durations",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Reports",
+          "comment": "from packaging metadata Project-URL: Bug Reports",
           "type": "issue-tracker",
           "url": "https://github.com/bolsote/isoduration/issues"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://github.com/bolsote/isoduration/blob/master/CHANGELOG"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/bolsote/isoduration"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/bolsote/isoduration"
         }
@@ -282,7 +282,7 @@
       "description": "Identify specific nodes in a JSON document (RFC 6901) ",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/stefankoegl/python-json-pointer"
         }
@@ -304,37 +304,37 @@
       "description": "An implementation of JSON Schema validation for Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://python-jsonschema.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Changelog",
+          "comment": "from packaging metadata Project-URL: Changelog",
           "type": "release-notes",
           "url": "https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema"
         }
@@ -356,32 +356,32 @@
       "description": "The JSON Schema meta-schemas and vocabularies, exposed as a Registry",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://jsonschema-specifications.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/jsonschema-specifications"
         }
@@ -403,7 +403,7 @@
       "description": "license-expression is a comprehensive utility library to parse, compare, simplify and normalize license expressions (such as SPDX license expressions) using boolean logic.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/nexB/license-expression"
         }
@@ -425,12 +425,12 @@
       "description": "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/lxml/lxml"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://lxml.de/"
         }
@@ -452,7 +452,7 @@
       "description": "A purl aka. Package URL parser and builder",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/package-url/packageurl-python"
         }
@@ -474,7 +474,7 @@
       "description": "Resolve a name to an object.",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/graingert/pkgutil-resolve-name"
         }
@@ -496,17 +496,17 @@
       "description": "Library for serializing and deserializing Python Objects to and from JSON and XML.",
       "externalReferences": [
         {
-          "comment": "Project-URL: Bug Tracker",
+          "comment": "from packaging metadata Project-URL: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://github.com/madpah/serializable/issues"
         },
         {
-          "comment": "Project-URL: Repository",
+          "comment": "from packaging metadata Project-URL: Repository",
           "type": "vcs",
           "url": "https://github.com/madpah/serializable"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/madpah/serializable"
         }
@@ -528,17 +528,17 @@
       "description": "Extensions to the standard Python datetime module",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://dateutil.readthedocs.io/en/stable/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/dateutil/dateutil"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/dateutil/dateutil"
         }
@@ -560,32 +560,32 @@
       "description": "JSON Referencing + Python",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://referencing.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/python-jsonschema/referencing/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/python-jsonschema/referencing"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/python-jsonschema/referencing"
         }
@@ -607,7 +607,7 @@
       "description": "A pure python RFC3339 validator",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/naimetti/rfc3339-validator"
         }
@@ -634,12 +634,12 @@
       "description": "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)",
       "externalReferences": [
         {
-          "comment": "Download-URL",
+          "comment": "from packaging metadata: Download-URL",
           "type": "distribution",
           "url": "https://github.com/dgerber/rfc3987"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://pypi.python.org/pypi/rfc3987"
         }
@@ -666,32 +666,32 @@
       "description": "Python bindings to Rust's persistent data structures (rpds)",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://rpds.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issues",
+          "comment": "from packaging metadata Project-URL: Issues",
           "type": "issue-tracker",
           "url": "https://github.com/crate-py/rpds/issues/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/crate-py/rpds"
         },
         {
-          "comment": "Project-URL: Funding",
+          "comment": "from packaging metadata Project-URL: Funding",
           "type": "other",
           "url": "https://github.com/sponsors/Julian"
         },
         {
-          "comment": "Project-URL: Tidelift",
+          "comment": "from packaging metadata Project-URL: Tidelift",
           "type": "other",
           "url": "https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link"
         },
         {
-          "comment": "Project-URL: Homepage",
+          "comment": "from packaging metadata Project-URL: Homepage",
           "type": "website",
           "url": "https://github.com/crate-py/rpds"
         }
@@ -713,7 +713,7 @@
       "description": "Python 2 and 3 compatibility utilities",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -735,7 +735,7 @@
       "description": "Sorted Containers -- Sorted List, Sorted Dict, Sorted Set",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "http://www.grantjenks.com/docs/sortedcontainers/"
         }
@@ -757,27 +757,27 @@
       "description": "Typing stubs for python-dateutil",
       "externalReferences": [
         {
-          "comment": "Project-URL: Chat",
+          "comment": "from packaging metadata Project-URL: Chat",
           "type": "chat",
           "url": "https://gitter.im/python/typing"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/python/typeshed/issues"
         },
         {
-          "comment": "Project-URL: Changes",
+          "comment": "from packaging metadata Project-URL: Changes",
           "type": "release-notes",
           "url": "https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md"
         },
         {
-          "comment": "Project-URL: GitHub",
+          "comment": "from packaging metadata Project-URL: GitHub",
           "type": "vcs",
           "url": "https://github.com/python/typeshed"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/python/typeshed"
         }
@@ -799,7 +799,7 @@
       "description": "RFC 6570 URI Template Processor",
       "externalReferences": [
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://gitlab.linss.com/open-source/python/uri-template"
         }
@@ -826,12 +826,12 @@
       "description": "A library for working with the color formats defined by HTML and CSS.",
       "externalReferences": [
         {
-          "comment": "Project-URL: documentation",
+          "comment": "from packaging metadata Project-URL: documentation",
           "type": "documentation",
           "url": "https://webcolors.readthedocs.io"
         },
         {
-          "comment": "Project-URL: homepage",
+          "comment": "from packaging metadata Project-URL: homepage",
           "type": "website",
           "url": "https://github.com/ubernostrum/webcolors"
         }
@@ -853,7 +853,7 @@
       "description": "Backport of pathlib-compatible object wrapper for zip files",
       "externalReferences": [
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/jaraco/zipp"
         }
@@ -1019,13 +1019,8 @@
   "metadata": {
     "component": {
       "bom-ref": "root-component",
-      "description": "packages with all meta, but no deps",
-      "licenses": [
-        {
-          "expression": "Apache-2.0 OR MIT"
-        }
-      ],
-      "name": "no-deps",
+      "description": "depenndencies with extras",
+      "name": "with-extras",
       "type": "application",
       "version": "0.1.0"
     },
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
index 16b60a61..c547b7a8 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
@@ -41,12 +41,9 @@
       </tool>
     </tools>
     <component type="application" bom-ref="root-component">
-      <name>no-deps</name>
+      <name>with-extras</name>
       <version>0.1.0</version>
-      <description>packages with all meta, but no deps</description>
-      <licenses>
-        <expression>Apache-2.0 OR MIT</expression>
-      </licenses>
+      <description>depenndencies with extras</description>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
@@ -61,15 +58,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://arrow.readthedocs.io</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/arrow-py/arrow/issues</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/arrow-py/arrow</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
       </externalReferences>
     </component>
@@ -86,27 +83,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://www.attrs.org/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-attrs/attrs/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-attrs/attrs</url>
-          <comment>Project-URL: Source Code</comment>
+          <comment>from packaging metadata Project-URL: Source Code</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/hynek</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&amp;utm_medium=pypi</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="release-notes">
           <url>https://www.attrs.org/en/stable/changelog.html</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -123,7 +120,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/bastikr/boolean.py</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -140,23 +137,23 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://cyclonedx-python-library.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://owasp.org/donate/?reponame=www-project-cyclonedx&amp;title=OWASP+CycloneDX</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/CycloneDX/cyclonedx-python-lib/#readme</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -176,11 +173,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://pypi.python.org/pypi/defusedxml</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/tiran/defusedxml</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -197,7 +194,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/ypcrts/fqdn</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -209,15 +206,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/kjd/idna/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/kjd/idna</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/kjd/idna/blob/master/HISTORY.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
       </externalReferences>
     </component>
@@ -229,11 +226,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://importlib-resources.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/importlib_resources</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -253,19 +250,19 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/bolsote/isoduration/issues</url>
-          <comment>Project-URL: Bug Reports</comment>
+          <comment>from packaging metadata Project-URL: Bug Reports</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/bolsote/isoduration/blob/master/CHANGELOG</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/bolsote/isoduration</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -282,7 +279,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/stefankoegl/python-json-pointer</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -299,31 +296,31 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://python-jsonschema.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst</url>
-          <comment>Project-URL: Changelog</comment>
+          <comment>from packaging metadata Project-URL: Changelog</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -340,27 +337,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://jsonschema-specifications.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/jsonschema-specifications/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-jsonschema-specifications?utm_source=pypi-jsonschema-specifications&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/jsonschema-specifications</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -377,7 +374,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/nexB/license-expression</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -394,11 +391,11 @@
       <externalReferences>
         <reference type="other">
           <url>https://github.com/lxml/lxml</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://lxml.de/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -415,7 +412,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/package-url/packageurl-python</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -432,7 +429,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/graingert/pkgutil-resolve-name</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -449,15 +446,15 @@
       <externalReferences>
         <reference type="issue-tracker">
           <url>https://github.com/madpah/serializable/issues</url>
-          <comment>Project-URL: Bug Tracker</comment>
+          <comment>from packaging metadata Project-URL: Bug Tracker</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Project-URL: Repository</comment>
+          <comment>from packaging metadata Project-URL: Repository</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/madpah/serializable</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -474,15 +471,15 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://dateutil.readthedocs.io/en/stable/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/dateutil/dateutil</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -499,27 +496,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://referencing.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python-jsonschema/referencing/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-referencing?utm_source=pypi-referencing&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python-jsonschema/referencing</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -539,7 +536,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/naimetti/rfc3339-validator</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -559,11 +556,11 @@
       <externalReferences>
         <reference type="distribution">
           <url>https://github.com/dgerber/rfc3987</url>
-          <comment>Download-URL</comment>
+          <comment>from packaging metadata: Download-URL</comment>
         </reference>
         <reference type="website">
           <url>http://pypi.python.org/pypi/rfc3987</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -580,27 +577,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://rpds.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/crate-py/rpds/issues/</url>
-          <comment>Project-URL: Issues</comment>
+          <comment>from packaging metadata Project-URL: Issues</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/sponsors/Julian</url>
-          <comment>Project-URL: Funding</comment>
+          <comment>from packaging metadata Project-URL: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&amp;utm_medium=referral&amp;utm_campaign=pypi-link</url>
-          <comment>Project-URL: Tidelift</comment>
+          <comment>from packaging metadata Project-URL: Tidelift</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/crate-py/rpds</url>
-          <comment>Project-URL: Homepage</comment>
+          <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -617,7 +614,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -634,7 +631,7 @@
       <externalReferences>
         <reference type="website">
           <url>http://www.grantjenks.com/docs/sortedcontainers/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -651,23 +648,23 @@
       <externalReferences>
         <reference type="chat">
           <url>https://gitter.im/python/typing</url>
-          <comment>Project-URL: Chat</comment>
+          <comment>from packaging metadata Project-URL: Chat</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/python/typeshed/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="release-notes">
           <url>https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/python-dateutil.md</url>
-          <comment>Project-URL: Changes</comment>
+          <comment>from packaging metadata Project-URL: Changes</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/python/typeshed</url>
-          <comment>Project-URL: GitHub</comment>
+          <comment>from packaging metadata Project-URL: GitHub</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/python/typeshed</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -687,7 +684,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://gitlab.linss.com/open-source/python/uri-template</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -704,11 +701,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://webcolors.readthedocs.io</url>
-          <comment>Project-URL: documentation</comment>
+          <comment>from packaging metadata Project-URL: documentation</comment>
         </reference>
         <reference type="website">
           <url>https://github.com/ubernostrum/webcolors</url>
-          <comment>Project-URL: homepage</comment>
+          <comment>from packaging metadata Project-URL: homepage</comment>
         </reference>
       </externalReferences>
     </component>
@@ -725,7 +722,7 @@
       <externalReferences>
         <reference type="website">
           <url>https://github.com/jaraco/zipp</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
index 277af824..9e80e69c 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.1.xml.bin
@@ -9,11 +9,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/pypa/packaging</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
@@ -38,7 +38,7 @@
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -59,19 +59,19 @@
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/urllib3/urllib3/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/urllib3/urllib3</url>
-          <comment>Project-URL: Code</comment>
+          <comment>from packaging metadata Project-URL: Code</comment>
         </reference>
         <reference type="website">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
index 13fdf9c9..13fef2f6 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.2.json.bin
@@ -5,12 +5,12 @@
       "description": "Core utilities for Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://packaging.pypa.io/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
         },
@@ -35,7 +35,7 @@
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -62,22 +62,22 @@
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://urllib3.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/urllib3/urllib3/issues"
         },
         {
-          "comment": "Project-URL: Code",
+          "comment": "from packaging metadata Project-URL: Code",
           "type": "other",
           "url": "https://github.com/urllib3/urllib3"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://urllib3.readthedocs.io/"
         }
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
index 07875404..603768d5 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.2.xml.bin
@@ -28,11 +28,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/pypa/packaging</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
@@ -57,7 +57,7 @@
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -78,19 +78,19 @@
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/urllib3/urllib3/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/urllib3/urllib3</url>
-          <comment>Project-URL: Code</comment>
+          <comment>from packaging metadata Project-URL: Code</comment>
         </reference>
         <reference type="website">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
index 93afaba8..37ed42b1 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.json.bin
@@ -5,12 +5,12 @@
       "description": "Core utilities for Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://packaging.pypa.io/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
         },
@@ -51,7 +51,7 @@
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -84,22 +84,22 @@
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://urllib3.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/urllib3/urllib3/issues"
         },
         {
-          "comment": "Project-URL: Code",
+          "comment": "from packaging metadata Project-URL: Code",
           "type": "other",
           "url": "https://github.com/urllib3/urllib3"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://urllib3.readthedocs.io/"
         }
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
index dc27cd5d..76e947dc 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.3.xml.bin
@@ -31,11 +31,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/pypa/packaging</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
@@ -67,7 +67,7 @@
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -91,19 +91,19 @@
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/urllib3/urllib3/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/urllib3/urllib3</url>
-          <comment>Project-URL: Code</comment>
+          <comment>from packaging metadata Project-URL: Code</comment>
         </reference>
         <reference type="website">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
index b4a20533..dd7ac2ae 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.json.bin
@@ -5,12 +5,12 @@
       "description": "Core utilities for Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://packaging.pypa.io/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
         },
@@ -51,7 +51,7 @@
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -84,22 +84,22 @@
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://urllib3.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/urllib3/urllib3/issues"
         },
         {
-          "comment": "Project-URL: Code",
+          "comment": "from packaging metadata Project-URL: Code",
           "type": "other",
           "url": "https://github.com/urllib3/urllib3"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://urllib3.readthedocs.io/"
         }
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
index 277e2add..a050a70a 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.4.xml.bin
@@ -58,11 +58,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/pypa/packaging</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
@@ -94,7 +94,7 @@
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -118,19 +118,19 @@
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/urllib3/urllib3/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/urllib3/urllib3</url>
-          <comment>Project-URL: Code</comment>
+          <comment>from packaging metadata Project-URL: Code</comment>
         </reference>
         <reference type="website">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
index a4e0d3bc..cbeba0ac 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.json.bin
@@ -5,12 +5,12 @@
       "description": "Core utilities for Python packages",
       "externalReferences": [
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://packaging.pypa.io/"
         },
         {
-          "comment": "Project-URL: Source",
+          "comment": "from packaging metadata Project-URL: Source",
           "type": "other",
           "url": "https://github.com/pypa/packaging"
         },
@@ -51,7 +51,7 @@
           "url": "https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://github.com/benjaminp/six"
         }
@@ -84,22 +84,22 @@
           "url": "https://github.com/urllib3/urllib3/archive/refs/tags/1.26.8.zip"
         },
         {
-          "comment": "Project-URL: Documentation",
+          "comment": "from packaging metadata Project-URL: Documentation",
           "type": "documentation",
           "url": "https://urllib3.readthedocs.io/"
         },
         {
-          "comment": "Project-URL: Issue tracker",
+          "comment": "from packaging metadata Project-URL: Issue tracker",
           "type": "issue-tracker",
           "url": "https://github.com/urllib3/urllib3/issues"
         },
         {
-          "comment": "Project-URL: Code",
+          "comment": "from packaging metadata Project-URL: Code",
           "type": "other",
           "url": "https://github.com/urllib3/urllib3"
         },
         {
-          "comment": "Home-page",
+          "comment": "from packaging metadata: Home-page",
           "type": "website",
           "url": "https://urllib3.readthedocs.io/"
         }
diff --git a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
index 0776367a..c962bfd9 100644
--- a/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-urls_1.5.xml.bin
@@ -58,11 +58,11 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://packaging.pypa.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/pypa/packaging</url>
-          <comment>Project-URL: Source</comment>
+          <comment>from packaging metadata Project-URL: Source</comment>
         </reference>
         <reference type="vcs">
           <url>https://github.com/pypa/packaging.git#b3a5d7d68991c040615d5345bb55f61de53ba176</url>
@@ -94,7 +94,7 @@
         </reference>
         <reference type="website">
           <url>https://github.com/benjaminp/six</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
@@ -118,19 +118,19 @@
         </reference>
         <reference type="documentation">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Project-URL: Documentation</comment>
+          <comment>from packaging metadata Project-URL: Documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://github.com/urllib3/urllib3/issues</url>
-          <comment>Project-URL: Issue tracker</comment>
+          <comment>from packaging metadata Project-URL: Issue tracker</comment>
         </reference>
         <reference type="other">
           <url>https://github.com/urllib3/urllib3</url>
-          <comment>Project-URL: Code</comment>
+          <comment>from packaging metadata Project-URL: Code</comment>
         </reference>
         <reference type="website">
           <url>https://urllib3.readthedocs.io/</url>
-          <comment>Home-page</comment>
+          <comment>from packaging metadata: Home-page</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.2.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.2.json.bin
index b1e74fb9..6de193b1 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.2.json.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.2.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.2.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.2.xml.bin
index 1aa0d581..a982f421 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.2.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <dependencies>
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
index 51944f0f..4922946d 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.3.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
index 6b024c83..f70c1e34 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
index 00aae6df..354ca1e5 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.4.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
index fdc1f9a7..3a1fc66d 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
index 788abb29..e246c19d 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.5.json.bin
@@ -8,6 +8,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "packages with all meta, but no deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin b/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
index 05b343fe..bf68b2e3 100644
--- a/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
+++ b/tests/_data/snapshots/pipenv/file_no-deps_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
index 7a801fe0..568e0c09 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
@@ -11,32 +11,32 @@
       "description": "packages with all meta, but no deps",
       "externalReferences": [
         {
-          "comment": "project metadata: documentation",
+          "comment": "from poetry: documentation",
           "type": "documentation",
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package url: Bug Tracker",
+          "comment": "from poetry url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package url: Funding",
+          "comment": "from poetry url: Funding",
           "type": "other",
           "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package url: Change log",
+          "comment": "from poetry url: Change log",
           "type": "other",
           "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
-          "comment": "project metadata: repository",
+          "comment": "from poetry: repository",
           "type": "vcs",
           "url": "https://oss.acme.org/my-project.git"
         },
         {
-          "comment": "project metadata: homepage",
+          "comment": "from poetry: homepage",
           "type": "website",
           "url": "https://oss.acme.org/my-project/"
         }
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
index ddcc52c2..6dbbe4bb 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
@@ -24,27 +24,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://oss.acme.org/my-project/docs/</url>
-          <comment>project metadata: documentation</comment>
+          <comment>from poetry: documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package url: Bug Tracker</comment>
+          <comment>from poetry url: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package url: Funding</comment>
+          <comment>from poetry url: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package url: Change log</comment>
+          <comment>from poetry url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
-          <comment>project metadata: repository</comment>
+          <comment>from poetry: repository</comment>
         </reference>
         <reference type="website">
           <url>https://oss.acme.org/my-project/</url>
-          <comment>project metadata: homepage</comment>
+          <comment>from poetry: homepage</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
index 332f4ffb..647522ce 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
@@ -11,32 +11,32 @@
       "description": "packages with all meta, but no deps",
       "externalReferences": [
         {
-          "comment": "project metadata: documentation",
+          "comment": "from poetry: documentation",
           "type": "documentation",
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package url: Bug Tracker",
+          "comment": "from poetry url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package url: Funding",
+          "comment": "from poetry url: Funding",
           "type": "other",
           "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package url: Change log",
+          "comment": "from poetry url: Change log",
           "type": "other",
           "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
-          "comment": "project metadata: repository",
+          "comment": "from poetry: repository",
           "type": "vcs",
           "url": "https://oss.acme.org/my-project.git"
         },
         {
-          "comment": "project metadata: homepage",
+          "comment": "from poetry: homepage",
           "type": "website",
           "url": "https://oss.acme.org/my-project/"
         }
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
index d609a7fa..57ffb583 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
@@ -24,27 +24,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://oss.acme.org/my-project/docs/</url>
-          <comment>project metadata: documentation</comment>
+          <comment>from poetry: documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package url: Bug Tracker</comment>
+          <comment>from poetry url: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package url: Funding</comment>
+          <comment>from poetry url: Funding</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package url: Change log</comment>
+          <comment>from poetry url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
-          <comment>project metadata: repository</comment>
+          <comment>from poetry: repository</comment>
         </reference>
         <reference type="website">
           <url>https://oss.acme.org/my-project/</url>
-          <comment>project metadata: homepage</comment>
+          <comment>from poetry: homepage</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
index 132c41c4..036a231d 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
@@ -11,32 +11,32 @@
       "description": "packages with all meta, but no deps",
       "externalReferences": [
         {
-          "comment": "project metadata: documentation",
+          "comment": "from poetry: documentation",
           "type": "documentation",
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package url: Bug Tracker",
+          "comment": "from poetry url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package url: Funding",
+          "comment": "from poetry url: Funding",
           "type": "other",
           "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package url: Change log",
+          "comment": "from poetry url: Change log",
           "type": "release-notes",
           "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
-          "comment": "project metadata: repository",
+          "comment": "from poetry: repository",
           "type": "vcs",
           "url": "https://oss.acme.org/my-project.git"
         },
         {
-          "comment": "project metadata: homepage",
+          "comment": "from poetry: homepage",
           "type": "website",
           "url": "https://oss.acme.org/my-project/"
         }
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
index f6545012..b146d784 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
@@ -51,27 +51,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://oss.acme.org/my-project/docs/</url>
-          <comment>project metadata: documentation</comment>
+          <comment>from poetry: documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package url: Bug Tracker</comment>
+          <comment>from poetry url: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package url: Funding</comment>
+          <comment>from poetry url: Funding</comment>
         </reference>
         <reference type="release-notes">
           <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package url: Change log</comment>
+          <comment>from poetry url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
-          <comment>project metadata: repository</comment>
+          <comment>from poetry: repository</comment>
         </reference>
         <reference type="website">
           <url>https://oss.acme.org/my-project/</url>
-          <comment>project metadata: homepage</comment>
+          <comment>from poetry: homepage</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
index e68a70f9..fab602de 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
@@ -11,32 +11,32 @@
       "description": "packages with all meta, but no deps",
       "externalReferences": [
         {
-          "comment": "project metadata: documentation",
+          "comment": "from poetry: documentation",
           "type": "documentation",
           "url": "https://oss.acme.org/my-project/docs/"
         },
         {
-          "comment": "package url: Bug Tracker",
+          "comment": "from poetry url: Bug Tracker",
           "type": "issue-tracker",
           "url": "https://oss.acme.org/my-project/bugs/"
         },
         {
-          "comment": "package url: Funding",
+          "comment": "from poetry url: Funding",
           "type": "other",
           "url": "https://oss.acme.org/my-project/funding/"
         },
         {
-          "comment": "package url: Change log",
+          "comment": "from poetry url: Change log",
           "type": "release-notes",
           "url": "https://oss.acme.org/my-project/changelog/"
         },
         {
-          "comment": "project metadata: repository",
+          "comment": "from poetry: repository",
           "type": "vcs",
           "url": "https://oss.acme.org/my-project.git"
         },
         {
-          "comment": "project metadata: homepage",
+          "comment": "from poetry: homepage",
           "type": "website",
           "url": "https://oss.acme.org/my-project/"
         }
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
index d4a2a958..731a93f0 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
@@ -51,27 +51,27 @@
       <externalReferences>
         <reference type="documentation">
           <url>https://oss.acme.org/my-project/docs/</url>
-          <comment>project metadata: documentation</comment>
+          <comment>from poetry: documentation</comment>
         </reference>
         <reference type="issue-tracker">
           <url>https://oss.acme.org/my-project/bugs/</url>
-          <comment>package url: Bug Tracker</comment>
+          <comment>from poetry url: Bug Tracker</comment>
         </reference>
         <reference type="other">
           <url>https://oss.acme.org/my-project/funding/</url>
-          <comment>package url: Funding</comment>
+          <comment>from poetry url: Funding</comment>
         </reference>
         <reference type="release-notes">
           <url>https://oss.acme.org/my-project/changelog/</url>
-          <comment>package url: Change log</comment>
+          <comment>from poetry url: Change log</comment>
         </reference>
         <reference type="vcs">
           <url>https://oss.acme.org/my-project.git</url>
-          <comment>project metadata: repository</comment>
+          <comment>from poetry: repository</comment>
         </reference>
         <reference type="website">
           <url>https://oss.acme.org/my-project/</url>
-          <comment>project metadata: homepage</comment>
+          <comment>from poetry: homepage</comment>
         </reference>
       </externalReferences>
     </component>
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.2.json.bin b/tests/_data/snapshots/requirements/file_frozen_1.2.json.bin
index c29e6eb5..b310506a 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.2.json.bin
@@ -46,6 +46,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.2.xml.bin b/tests/_data/snapshots/requirements/file_frozen_1.2.xml.bin
index 139772dd..3513da77 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin b/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
index d0534648..1a155d4d 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.3.json.bin
@@ -56,6 +56,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin b/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
index 44969e9a..dd17bee7 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin b/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
index eaeb8f7e..4983dca5 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.4.json.bin
@@ -56,6 +56,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin b/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
index fe282242..c0bf64b0 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin b/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
index 22ba17a5..d47b7f69 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.5.json.bin
@@ -56,6 +56,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin b/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
index 6bb58f28..ca2880eb 100644
--- a/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_frozen_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_local_1.2.json.bin b/tests/_data/snapshots/requirements/file_local_1.2.json.bin
index b525083c..4d3b1d8c 100644
--- a/tests/_data/snapshots/requirements/file_local_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.2.json.bin
@@ -112,6 +112,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_local_1.2.xml.bin b/tests/_data/snapshots/requirements/file_local_1.2.xml.bin
index 9fe8a9c2..b03d2cd5 100644
--- a/tests/_data/snapshots/requirements/file_local_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_local_1.3.json.bin b/tests/_data/snapshots/requirements/file_local_1.3.json.bin
index 2f791bad..9a38c93d 100644
--- a/tests/_data/snapshots/requirements/file_local_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.3.json.bin
@@ -118,6 +118,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_local_1.3.xml.bin b/tests/_data/snapshots/requirements/file_local_1.3.xml.bin
index 1c202b23..e1618e94 100644
--- a/tests/_data/snapshots/requirements/file_local_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_local_1.4.json.bin b/tests/_data/snapshots/requirements/file_local_1.4.json.bin
index 0b1c1df9..960e8bce 100644
--- a/tests/_data/snapshots/requirements/file_local_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.4.json.bin
@@ -113,6 +113,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_local_1.4.xml.bin b/tests/_data/snapshots/requirements/file_local_1.4.xml.bin
index 1791cb7d..0a1ef26d 100644
--- a/tests/_data/snapshots/requirements/file_local_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_local_1.5.json.bin b/tests/_data/snapshots/requirements/file_local_1.5.json.bin
index b4cbfb5c..a040c790 100644
--- a/tests/_data/snapshots/requirements/file_local_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.5.json.bin
@@ -113,6 +113,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_local_1.5.xml.bin b/tests/_data/snapshots/requirements/file_local_1.5.xml.bin
index 2b7e2712..9a1df7d5 100644
--- a/tests/_data/snapshots/requirements/file_local_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_local_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_nested_1.2.json.bin b/tests/_data/snapshots/requirements/file_nested_1.2.json.bin
index c29e6eb5..b310506a 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.2.json.bin
@@ -46,6 +46,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_nested_1.2.xml.bin b/tests/_data/snapshots/requirements/file_nested_1.2.xml.bin
index 139772dd..3513da77 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_nested_1.3.json.bin b/tests/_data/snapshots/requirements/file_nested_1.3.json.bin
index d0534648..1a155d4d 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.3.json.bin
@@ -56,6 +56,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin b/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
index 44969e9a..dd17bee7 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_nested_1.4.json.bin b/tests/_data/snapshots/requirements/file_nested_1.4.json.bin
index eaeb8f7e..4983dca5 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.4.json.bin
@@ -56,6 +56,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin b/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
index fe282242..c0bf64b0 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_nested_1.5.json.bin b/tests/_data/snapshots/requirements/file_nested_1.5.json.bin
index 22ba17a5..d47b7f69 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.5.json.bin
@@ -56,6 +56,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin b/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
index 6bb58f28..ca2880eb 100644
--- a/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_nested_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.2.json.bin b/tests/_data/snapshots/requirements/file_private-packages_1.2.json.bin
index 176a0215..753b96de 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.2.json.bin
@@ -38,6 +38,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.2.xml.bin b/tests/_data/snapshots/requirements/file_private-packages_1.2.xml.bin
index a19d7074..1796a28e 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin b/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
index 8a060a9d..3c684131 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.3.json.bin
@@ -38,6 +38,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin b/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
index f6587742..e4d01b8f 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin b/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
index ccf4350f..2fee87a9 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.4.json.bin
@@ -38,6 +38,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin b/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
index 5a83c1cc..9874fcef 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin b/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
index bf252450..7f68c0dd 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.5.json.bin
@@ -38,6 +38,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin b/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
index d5edbe76..ebd1ce40 100644
--- a/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_private-packages_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.json.bin
index 19f78edb..895b3a68 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.json.bin
@@ -64,6 +64,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.xml.bin
index 2d0792bd..9044b8e3 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
index 1598a9bd..98f06000 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.json.bin
@@ -64,6 +64,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
index c31bfae8..828994c4 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
index a7333582..22a54c59 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.json.bin
@@ -61,6 +61,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
index 99dd4ab9..49ebd84a 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
index c91f2491..2604f871 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.json.bin
@@ -61,6 +61,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
index d0e9c94d..183b9b0c 100644
--- a/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_regression-issue448.cp1252.txt_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.2.json.bin b/tests/_data/snapshots/requirements/file_with-comments_1.2.json.bin
index a2594e2c..f7f52c2c 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.2.json.bin
@@ -100,6 +100,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.2.xml.bin b/tests/_data/snapshots/requirements/file_with-comments_1.2.xml.bin
index 473bf115..7037b0fc 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
index d0100540..be168f13 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.3.json.bin
@@ -100,6 +100,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
index d07a8b6a..9c87d8d4 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
index 853118bb..e6ceefaa 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.4.json.bin
@@ -100,6 +100,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
index 647e9ce3..be40617c 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
index b98b9144..2154f2fb 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.5.json.bin
@@ -100,6 +100,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
index f52f1f90..82d91657 100644
--- a/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-comments_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.2.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.2.json.bin
index 660f6aa2..7dcde577 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.2.json.bin
@@ -28,6 +28,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.2.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.2.xml.bin
index ee6f0427..1eb84df9 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
index d0fd31d5..52d42e29 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.3.json.bin
@@ -38,6 +38,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
index 79eac39a..041cc4bf 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
index f534b553..99134644 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.4.json.bin
@@ -38,6 +38,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
index 0984799d..aa2e029d 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
index f13a4eb1..816a9804 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.5.json.bin
@@ -38,6 +38,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
index 3309fd71..eadf49f4 100644
--- a/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-extras_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.2.json.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.2.json.bin
index aa096cbe..ab177505 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.2.json.bin
@@ -100,6 +100,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.2.xml.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.2.xml.bin
index 26192663..5b7ba0a8 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
index 1d8df625..7517fa27 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.3.json.bin
@@ -140,6 +140,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
index 5d56cf9a..009476f8 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
index b58bc387..99c0a8f9 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.4.json.bin
@@ -139,6 +139,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
index 1e46eb1e..069637b1 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
index b527a4cf..5779dd45 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.5.json.bin
@@ -139,6 +139,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
index afff1cab..674809ba 100644
--- a/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-hashes_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.2.json.bin b/tests/_data/snapshots/requirements/file_with-urls_1.2.json.bin
index 21c3c538..8ee9ce35 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.2.json.bin
@@ -135,6 +135,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.2.xml.bin b/tests/_data/snapshots/requirements/file_with-urls_1.2.xml.bin
index 0c0972ec..9070e5be 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin b/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
index 0b1f799d..61de566f 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.3.json.bin
@@ -135,6 +135,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin b/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
index 8bd5ed10..6bc10c75 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin b/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
index 74c8c901..0e5258eb 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.4.json.bin
@@ -129,6 +129,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin b/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
index 0fa54467..661f5087 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin b/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
index 9c58e7a9..9f87097c 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.5.json.bin
@@ -129,6 +129,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin b/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
index e449a302..79816cf5 100644
--- a/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_with-urls_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.json.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.json.bin
index c34b6a5c..50e4dd1a 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.json.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.json.bin
@@ -64,6 +64,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.xml.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.xml.bin
index 5e3f61a8..a6d9bd9a 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.xml.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.2.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
   </metadata>
   <components>
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
index e77bfff4..7a1ac173 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.json.bin
@@ -64,6 +64,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
index c25d0c94..53a23229 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.3.xml.bin
@@ -20,6 +20,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
index 1dc26a60..409a79fb 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.json.bin
@@ -61,6 +61,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
index 0d2bbbb0..23f134be 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.4.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
index 843e8a03..911b3c56 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.json.bin
@@ -61,6 +61,38 @@
     "component": {
       "bom-ref": "root-component",
       "description": "some `reuqirements.txt` a root-component with all metadata",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
       "licenses": [
         {
           "expression": "Apache-2.0 OR MIT"
diff --git a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
index 57709bf9..85acbb02 100644
--- a/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
+++ b/tests/_data/snapshots/requirements/file_without-pinned-versions_1.5.xml.bin
@@ -47,6 +47,32 @@
       <licenses>
         <expression>Apache-2.0 OR MIT</expression>
       </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
     </component>
     <properties>
       <property name="cdx:reproducible">true</property>

From 4b4b6e79a5da34c3f2309c8740c7d7f8a9b0e11a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 02:10:23 +0100
Subject: [PATCH 153/155] Rewrite 4 more pyproject2 (#636)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .envrc                                        |   3 +
 cyclonedx_py/_internal/cli_common.py          |  32 ++++
 cyclonedx_py/_internal/environment.py         | 149 ++++++++++--------
 cyclonedx_py/_internal/pipenv.py              |  28 +---
 cyclonedx_py/_internal/poetry.py              |  79 +---------
 cyclonedx_py/_internal/requirements.py        |  29 +---
 cyclonedx_py/_internal/utils/packaging.py     |   4 +-
 cyclonedx_py/_internal/utils/pep610.py        |   2 +-
 cyclonedx_py/_internal/utils/pep621.py        |  79 ++++------
 cyclonedx_py/_internal/utils/pep631.py        |  29 ----
 cyclonedx_py/_internal/utils/poetry.py        | 103 ++++++++++++
 cyclonedx_py/_internal/utils/pyproject.py     |  48 +++++-
 poetry.toml                                   |   6 +
 pyproject.toml                                |   7 +-
 .../infiles/environment/editable-self/init.py |   7 +-
 tests/_data/infiles/environment/local/init.py |   7 +-
 .../_data/infiles/environment/no-deps/init.py |   2 -
 .../infiles/environment/via-pipenv/Pipfile    |  18 +++
 .../environment/via-pipenv/Pipfile.lock       |  99 ++++++++++++
 .../infiles/environment/via-pipenv/init.py    |  63 ++++++++
 .../environment/via-pipenv/pyproject.toml     |  42 +++++
 .../infiles/environment/via-poetry/dummy.py   |   0
 .../infiles/environment/via-poetry/init.py    |  38 +++++
 .../environment/via-poetry/poetry.lock        | 108 +++++++++++++
 .../environment/via-poetry/poetry.toml        |   6 +
 .../environment/via-poetry/pyproject.toml     |  51 ++++++
 .../infiles/environment/with-extras/init.py   |   4 +-
 .../infiles/environment/with-urls/init.py     |   7 +-
 tests/_data/infiles/pipenv/.envrc             |   6 +-
 tests/_data/infiles/poetry/.envrc             |   5 -
 .../environment/venv_via-pipenv_1.0.xml.bin   |  12 ++
 .../environment/venv_via-pipenv_1.1.xml.bin   |  22 +++
 .../environment/venv_via-pipenv_1.2.json.bin  |  99 ++++++++++++
 .../environment/venv_via-pipenv_1.2.xml.bin   |  76 +++++++++
 .../environment/venv_via-pipenv_1.3.json.bin  | 105 ++++++++++++
 .../environment/venv_via-pipenv_1.3.xml.bin   |  79 ++++++++++
 .../environment/venv_via-pipenv_1.4.json.bin  | 101 ++++++++++++
 .../environment/venv_via-pipenv_1.4.xml.bin   | 106 +++++++++++++
 .../environment/venv_via-pipenv_1.5.json.bin  | 101 ++++++++++++
 .../environment/venv_via-pipenv_1.5.xml.bin   | 106 +++++++++++++
 .../environment/venv_via-poetry_1.0.xml.bin   |  12 ++
 .../environment/venv_via-poetry_1.1.xml.bin   |  22 +++
 .../environment/venv_via-poetry_1.2.json.bin  |  99 ++++++++++++
 .../environment/venv_via-poetry_1.2.xml.bin   |  76 +++++++++
 .../environment/venv_via-poetry_1.3.json.bin  | 105 ++++++++++++
 .../environment/venv_via-poetry_1.3.xml.bin   |  79 ++++++++++
 .../environment/venv_via-poetry_1.4.json.bin  | 101 ++++++++++++
 .../environment/venv_via-poetry_1.4.xml.bin   | 106 +++++++++++++
 .../environment/venv_via-poetry_1.5.json.bin  | 101 ++++++++++++
 .../environment/venv_via-poetry_1.5.xml.bin   | 106 +++++++++++++
 .../environment/venv_with-extras_1.2.json.bin |   3 -
 .../environment/venv_with-extras_1.2.xml.bin  |   4 +-
 .../environment/venv_with-extras_1.3.json.bin |   9 +-
 .../environment/venv_with-extras_1.3.xml.bin  |   7 +-
 .../environment/venv_with-extras_1.4.json.bin |   9 +-
 .../environment/venv_with-extras_1.4.xml.bin  |   7 +-
 .../environment/venv_with-extras_1.5.json.bin |   9 +-
 .../environment/venv_with-extras_1.5.xml.bin  |   7 +-
 .../poetry/group-deps_lock11_1.2.json.bin     |   1 -
 .../poetry/group-deps_lock11_1.2.xml.bin      |   1 -
 .../poetry/group-deps_lock11_1.3.json.bin     |   1 -
 .../poetry/group-deps_lock11_1.3.xml.bin      |   1 -
 .../poetry/group-deps_lock11_1.4.json.bin     |   1 -
 .../poetry/group-deps_lock11_1.4.xml.bin      |   1 -
 .../poetry/group-deps_lock11_1.5.json.bin     |   1 -
 .../poetry/group-deps_lock11_1.5.xml.bin      |   1 -
 .../poetry/group-deps_lock20_1.2.json.bin     |   1 -
 .../poetry/group-deps_lock20_1.2.xml.bin      |   1 -
 .../poetry/group-deps_lock20_1.3.json.bin     |   1 -
 .../poetry/group-deps_lock20_1.3.xml.bin      |   1 -
 .../poetry/group-deps_lock20_1.4.json.bin     |   1 -
 .../poetry/group-deps_lock20_1.4.xml.bin      |   1 -
 .../poetry/group-deps_lock20_1.5.json.bin     |   1 -
 .../poetry/group-deps_lock20_1.5.xml.bin      |   1 -
 .../poetry/local_lock10_1.2.json.bin          |   1 -
 .../snapshots/poetry/local_lock10_1.2.xml.bin |   1 -
 .../poetry/local_lock10_1.3.json.bin          |   1 -
 .../snapshots/poetry/local_lock10_1.3.xml.bin |   1 -
 .../poetry/local_lock10_1.4.json.bin          |   1 -
 .../snapshots/poetry/local_lock10_1.4.xml.bin |   1 -
 .../poetry/local_lock10_1.5.json.bin          |   1 -
 .../snapshots/poetry/local_lock10_1.5.xml.bin |   1 -
 .../poetry/local_lock11_1.2.json.bin          |   1 -
 .../snapshots/poetry/local_lock11_1.2.xml.bin |   1 -
 .../poetry/local_lock11_1.3.json.bin          |   1 -
 .../snapshots/poetry/local_lock11_1.3.xml.bin |   1 -
 .../poetry/local_lock11_1.4.json.bin          |   1 -
 .../snapshots/poetry/local_lock11_1.4.xml.bin |   1 -
 .../poetry/local_lock11_1.5.json.bin          |   1 -
 .../snapshots/poetry/local_lock11_1.5.xml.bin |   1 -
 .../poetry/local_lock20_1.2.json.bin          |   1 -
 .../snapshots/poetry/local_lock20_1.2.xml.bin |   1 -
 .../poetry/local_lock20_1.3.json.bin          |   1 -
 .../snapshots/poetry/local_lock20_1.3.xml.bin |   1 -
 .../poetry/local_lock20_1.4.json.bin          |   1 -
 .../snapshots/poetry/local_lock20_1.4.xml.bin |   1 -
 .../poetry/local_lock20_1.5.json.bin          |   1 -
 .../snapshots/poetry/local_lock20_1.5.xml.bin |   1 -
 .../poetry/main-and-dev_lock10_1.2.json.bin   |   1 -
 .../poetry/main-and-dev_lock10_1.2.xml.bin    |   1 -
 .../poetry/main-and-dev_lock10_1.3.json.bin   |   1 -
 .../poetry/main-and-dev_lock10_1.3.xml.bin    |   1 -
 .../poetry/main-and-dev_lock10_1.4.json.bin   |   1 -
 .../poetry/main-and-dev_lock10_1.4.xml.bin    |   1 -
 .../poetry/main-and-dev_lock10_1.5.json.bin   |   1 -
 .../poetry/main-and-dev_lock10_1.5.xml.bin    |   1 -
 .../poetry/main-and-dev_lock11_1.2.json.bin   |   1 -
 .../poetry/main-and-dev_lock11_1.2.xml.bin    |   1 -
 .../poetry/main-and-dev_lock11_1.3.json.bin   |   1 -
 .../poetry/main-and-dev_lock11_1.3.xml.bin    |   1 -
 .../poetry/main-and-dev_lock11_1.4.json.bin   |   1 -
 .../poetry/main-and-dev_lock11_1.4.xml.bin    |   1 -
 .../poetry/main-and-dev_lock11_1.5.json.bin   |   1 -
 .../poetry/main-and-dev_lock11_1.5.xml.bin    |   1 -
 .../poetry/main-and-dev_lock20_1.2.json.bin   |   1 -
 .../poetry/main-and-dev_lock20_1.2.xml.bin    |   1 -
 .../poetry/main-and-dev_lock20_1.3.json.bin   |   1 -
 .../poetry/main-and-dev_lock20_1.3.xml.bin    |   1 -
 .../poetry/main-and-dev_lock20_1.4.json.bin   |   1 -
 .../poetry/main-and-dev_lock20_1.4.xml.bin    |   1 -
 .../poetry/main-and-dev_lock20_1.5.json.bin   |   1 -
 .../poetry/main-and-dev_lock20_1.5.xml.bin    |   1 -
 .../poetry/no-deps_lock20_1.2.json.bin        |   1 -
 .../poetry/no-deps_lock20_1.2.xml.bin         |   1 -
 .../poetry/no-deps_lock20_1.3.json.bin        |   1 -
 .../poetry/no-deps_lock20_1.3.xml.bin         |   1 -
 .../poetry/no-deps_lock20_1.4.json.bin        |   1 -
 .../poetry/no-deps_lock20_1.4.xml.bin         |   1 -
 .../poetry/no-deps_lock20_1.5.json.bin        |   1 -
 .../poetry/no-deps_lock20_1.5.xml.bin         |   1 -
 .../poetry/no-dev_lock11_1.2.json.bin         |   1 -
 .../poetry/no-dev_lock11_1.2.xml.bin          |   1 -
 .../poetry/no-dev_lock11_1.3.json.bin         |   1 -
 .../poetry/no-dev_lock11_1.3.xml.bin          |   1 -
 .../poetry/no-dev_lock11_1.4.json.bin         |   1 -
 .../poetry/no-dev_lock11_1.4.xml.bin          |   1 -
 .../poetry/no-dev_lock11_1.5.json.bin         |   1 -
 .../poetry/no-dev_lock11_1.5.xml.bin          |   1 -
 .../poetry/no-dev_lock20_1.2.json.bin         |   1 -
 .../poetry/no-dev_lock20_1.2.xml.bin          |   1 -
 .../poetry/no-dev_lock20_1.3.json.bin         |   1 -
 .../poetry/no-dev_lock20_1.3.xml.bin          |   1 -
 .../poetry/no-dev_lock20_1.4.json.bin         |   1 -
 .../poetry/no-dev_lock20_1.4.xml.bin          |   1 -
 .../poetry/no-dev_lock20_1.5.json.bin         |   1 -
 .../poetry/no-dev_lock20_1.5.xml.bin          |   1 -
 .../poetry/only-groups_lock11_1.2.json.bin    |   1 -
 .../poetry/only-groups_lock11_1.2.xml.bin     |   1 -
 .../poetry/only-groups_lock11_1.3.json.bin    |   1 -
 .../poetry/only-groups_lock11_1.3.xml.bin     |   1 -
 .../poetry/only-groups_lock11_1.4.json.bin    |   1 -
 .../poetry/only-groups_lock11_1.4.xml.bin     |   1 -
 .../poetry/only-groups_lock11_1.5.json.bin    |   1 -
 .../poetry/only-groups_lock11_1.5.xml.bin     |   1 -
 .../poetry/only-groups_lock20_1.2.json.bin    |   1 -
 .../poetry/only-groups_lock20_1.2.xml.bin     |   1 -
 .../poetry/only-groups_lock20_1.3.json.bin    |   1 -
 .../poetry/only-groups_lock20_1.3.xml.bin     |   1 -
 .../poetry/only-groups_lock20_1.4.json.bin    |   1 -
 .../poetry/only-groups_lock20_1.4.xml.bin     |   1 -
 .../poetry/only-groups_lock20_1.5.json.bin    |   1 -
 .../poetry/only-groups_lock20_1.5.xml.bin     |   1 -
 .../private-packges_lock10_1.2.json.bin       |   1 -
 .../poetry/private-packges_lock10_1.2.xml.bin |   1 -
 .../private-packges_lock10_1.3.json.bin       |   1 -
 .../poetry/private-packges_lock10_1.3.xml.bin |   1 -
 .../private-packges_lock10_1.4.json.bin       |   1 -
 .../poetry/private-packges_lock10_1.4.xml.bin |   1 -
 .../private-packges_lock10_1.5.json.bin       |   1 -
 .../poetry/private-packges_lock10_1.5.xml.bin |   1 -
 .../private-packges_lock11_1.2.json.bin       |   1 -
 .../poetry/private-packges_lock11_1.2.xml.bin |   1 -
 .../private-packges_lock11_1.3.json.bin       |   1 -
 .../poetry/private-packges_lock11_1.3.xml.bin |   1 -
 .../private-packges_lock11_1.4.json.bin       |   1 -
 .../poetry/private-packges_lock11_1.4.xml.bin |   1 -
 .../private-packges_lock11_1.5.json.bin       |   1 -
 .../poetry/private-packges_lock11_1.5.xml.bin |   1 -
 .../private-packges_lock20_1.2.json.bin       |   1 -
 .../poetry/private-packges_lock20_1.2.xml.bin |   1 -
 .../private-packges_lock20_1.3.json.bin       |   1 -
 .../poetry/private-packges_lock20_1.3.xml.bin |   1 -
 .../private-packges_lock20_1.4.json.bin       |   1 -
 .../poetry/private-packges_lock20_1.4.xml.bin |   1 -
 .../private-packges_lock20_1.5.json.bin       |   1 -
 .../poetry/private-packges_lock20_1.5.xml.bin |   1 -
 .../regression-issue611_lock20_1.2.json.bin   |   1 -
 .../regression-issue611_lock20_1.2.xml.bin    |   1 -
 .../regression-issue611_lock20_1.3.json.bin   |   1 -
 .../regression-issue611_lock20_1.3.xml.bin    |   1 -
 .../regression-issue611_lock20_1.4.json.bin   |   1 -
 .../regression-issue611_lock20_1.4.xml.bin    |   1 -
 .../regression-issue611_lock20_1.5.json.bin   |   1 -
 .../regression-issue611_lock20_1.5.xml.bin    |   1 -
 .../poetry/some-extras_lock10_1.2.json.bin    |   1 -
 .../poetry/some-extras_lock10_1.2.xml.bin     |   1 -
 .../poetry/some-extras_lock10_1.3.json.bin    |   1 -
 .../poetry/some-extras_lock10_1.3.xml.bin     |   1 -
 .../poetry/some-extras_lock10_1.4.json.bin    |   1 -
 .../poetry/some-extras_lock10_1.4.xml.bin     |   1 -
 .../poetry/some-extras_lock10_1.5.json.bin    |   1 -
 .../poetry/some-extras_lock10_1.5.xml.bin     |   1 -
 .../poetry/some-extras_lock11_1.2.json.bin    |   1 -
 .../poetry/some-extras_lock11_1.2.xml.bin     |   1 -
 .../poetry/some-extras_lock11_1.3.json.bin    |   1 -
 .../poetry/some-extras_lock11_1.3.xml.bin     |   1 -
 .../poetry/some-extras_lock11_1.4.json.bin    |   1 -
 .../poetry/some-extras_lock11_1.4.xml.bin     |   1 -
 .../poetry/some-extras_lock11_1.5.json.bin    |   1 -
 .../poetry/some-extras_lock11_1.5.xml.bin     |   1 -
 .../poetry/some-extras_lock20_1.2.json.bin    |   1 -
 .../poetry/some-extras_lock20_1.2.xml.bin     |   1 -
 .../poetry/some-extras_lock20_1.3.json.bin    |   1 -
 .../poetry/some-extras_lock20_1.3.xml.bin     |   1 -
 .../poetry/some-extras_lock20_1.4.json.bin    |   1 -
 .../poetry/some-extras_lock20_1.4.xml.bin     |   1 -
 .../poetry/some-extras_lock20_1.5.json.bin    |   1 -
 .../poetry/some-extras_lock20_1.5.xml.bin     |   1 -
 .../poetry/some-groups_lock11_1.2.json.bin    |   1 -
 .../poetry/some-groups_lock11_1.2.xml.bin     |   1 -
 .../poetry/some-groups_lock11_1.3.json.bin    |   1 -
 .../poetry/some-groups_lock11_1.3.xml.bin     |   1 -
 .../poetry/some-groups_lock11_1.4.json.bin    |   1 -
 .../poetry/some-groups_lock11_1.4.xml.bin     |   1 -
 .../poetry/some-groups_lock11_1.5.json.bin    |   1 -
 .../poetry/some-groups_lock11_1.5.xml.bin     |   1 -
 .../poetry/some-groups_lock20_1.2.json.bin    |   1 -
 .../poetry/some-groups_lock20_1.2.xml.bin     |   1 -
 .../poetry/some-groups_lock20_1.3.json.bin    |   1 -
 .../poetry/some-groups_lock20_1.3.xml.bin     |   1 -
 .../poetry/some-groups_lock20_1.4.json.bin    |   1 -
 .../poetry/some-groups_lock20_1.4.xml.bin     |   1 -
 .../poetry/some-groups_lock20_1.5.json.bin    |   1 -
 .../poetry/some-groups_lock20_1.5.xml.bin     |   1 -
 .../poetry/with-extras_lock10_1.2.json.bin    |   1 -
 .../poetry/with-extras_lock10_1.2.xml.bin     |   1 -
 .../poetry/with-extras_lock10_1.3.json.bin    |   1 -
 .../poetry/with-extras_lock10_1.3.xml.bin     |   1 -
 .../poetry/with-extras_lock10_1.4.json.bin    |   1 -
 .../poetry/with-extras_lock10_1.4.xml.bin     |   1 -
 .../poetry/with-extras_lock10_1.5.json.bin    |   1 -
 .../poetry/with-extras_lock10_1.5.xml.bin     |   1 -
 .../poetry/with-extras_lock11_1.2.json.bin    |   1 -
 .../poetry/with-extras_lock11_1.2.xml.bin     |   1 -
 .../poetry/with-extras_lock11_1.3.json.bin    |   1 -
 .../poetry/with-extras_lock11_1.3.xml.bin     |   1 -
 .../poetry/with-extras_lock11_1.4.json.bin    |   1 -
 .../poetry/with-extras_lock11_1.4.xml.bin     |   1 -
 .../poetry/with-extras_lock11_1.5.json.bin    |   1 -
 .../poetry/with-extras_lock11_1.5.xml.bin     |   1 -
 .../poetry/with-extras_lock20_1.2.json.bin    |   1 -
 .../poetry/with-extras_lock20_1.2.xml.bin     |   1 -
 .../poetry/with-extras_lock20_1.3.json.bin    |   1 -
 .../poetry/with-extras_lock20_1.3.xml.bin     |   1 -
 .../poetry/with-extras_lock20_1.4.json.bin    |   1 -
 .../poetry/with-extras_lock20_1.4.xml.bin     |   1 -
 .../poetry/with-extras_lock20_1.5.json.bin    |   1 -
 .../poetry/with-extras_lock20_1.5.xml.bin     |   1 -
 .../poetry/with-urls_lock10_1.2.json.bin      |   1 -
 .../poetry/with-urls_lock10_1.2.xml.bin       |   1 -
 .../poetry/with-urls_lock10_1.3.json.bin      |   1 -
 .../poetry/with-urls_lock10_1.3.xml.bin       |   1 -
 .../poetry/with-urls_lock10_1.4.json.bin      |   1 -
 .../poetry/with-urls_lock10_1.4.xml.bin       |   1 -
 .../poetry/with-urls_lock10_1.5.json.bin      |   1 -
 .../poetry/with-urls_lock10_1.5.xml.bin       |   1 -
 .../poetry/with-urls_lock11_1.2.json.bin      |   1 -
 .../poetry/with-urls_lock11_1.2.xml.bin       |   1 -
 .../poetry/with-urls_lock11_1.3.json.bin      |   1 -
 .../poetry/with-urls_lock11_1.3.xml.bin       |   1 -
 .../poetry/with-urls_lock11_1.4.json.bin      |   1 -
 .../poetry/with-urls_lock11_1.4.xml.bin       |   1 -
 .../poetry/with-urls_lock11_1.5.json.bin      |   1 -
 .../poetry/with-urls_lock11_1.5.xml.bin       |   1 -
 .../poetry/with-urls_lock20_1.2.json.bin      |   1 -
 .../poetry/with-urls_lock20_1.2.xml.bin       |   1 -
 .../poetry/with-urls_lock20_1.3.json.bin      |   1 -
 .../poetry/with-urls_lock20_1.3.xml.bin       |   1 -
 .../poetry/with-urls_lock20_1.4.json.bin      |   1 -
 .../poetry/with-urls_lock20_1.4.xml.bin       |   1 -
 .../poetry/with-urls_lock20_1.5.json.bin      |   1 -
 .../poetry/with-urls_lock20_1.5.xml.bin       |   1 -
 tests/integration/test_cli_environment.py     |  22 +--
 283 files changed, 2420 insertions(+), 556 deletions(-)
 create mode 100644 .envrc
 create mode 100644 cyclonedx_py/_internal/cli_common.py
 delete mode 100644 cyclonedx_py/_internal/utils/pep631.py
 create mode 100644 cyclonedx_py/_internal/utils/poetry.py
 create mode 100644 poetry.toml
 mode change 100755 => 100644 tests/_data/infiles/environment/editable-self/init.py
 mode change 100755 => 100644 tests/_data/infiles/environment/local/init.py
 mode change 100755 => 100644 tests/_data/infiles/environment/no-deps/init.py
 create mode 100644 tests/_data/infiles/environment/via-pipenv/Pipfile
 create mode 100644 tests/_data/infiles/environment/via-pipenv/Pipfile.lock
 create mode 100644 tests/_data/infiles/environment/via-pipenv/init.py
 create mode 100644 tests/_data/infiles/environment/via-pipenv/pyproject.toml
 create mode 100644 tests/_data/infiles/environment/via-poetry/dummy.py
 create mode 100644 tests/_data/infiles/environment/via-poetry/init.py
 create mode 100644 tests/_data/infiles/environment/via-poetry/poetry.lock
 create mode 100644 tests/_data/infiles/environment/via-poetry/poetry.toml
 create mode 100644 tests/_data/infiles/environment/via-poetry/pyproject.toml
 mode change 100755 => 100644 tests/_data/infiles/environment/with-extras/init.py
 mode change 100755 => 100644 tests/_data/infiles/environment/with-urls/init.py
 delete mode 100644 tests/_data/infiles/poetry/.envrc
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin
 create mode 100644 tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin

diff --git a/.envrc b/.envrc
new file mode 100644
index 00000000..72c4d136
--- /dev/null
+++ b/.envrc
@@ -0,0 +1,3 @@
+# https://pipenv.pypa.io/en/latest/configuration.html
+export PIPENV_IGNORE_VIRTUALENVS=1
+
diff --git a/cyclonedx_py/_internal/cli_common.py b/cyclonedx_py/_internal/cli_common.py
new file mode 100644
index 00000000..69fcd56b
--- /dev/null
+++ b/cyclonedx_py/_internal/cli_common.py
@@ -0,0 +1,32 @@
+from typing import TYPE_CHECKING
+
+from .utils.args import argparse_type4enum
+
+if TYPE_CHECKING:  # pragma: no cover
+    from argparse import Action, ArgumentParser
+
+
+def add_argument_pyproject(p: 'ArgumentParser') -> 'Action':
+    return p.add_argument('--pyproject',
+                          metavar='FILE',
+                          help="Path to the root component's `pyproject.toml` file. "
+                               'This should point to a file compliant with PEP 621 '
+                               '(storing project metadata).',
+                          dest='pyproject_file',
+                          default=None)
+
+
+def add_argument_mc_type(p: 'ArgumentParser') -> 'Action':
+    from cyclonedx.model.component import ComponentType
+    choices = [ComponentType.APPLICATION,
+               ComponentType.FIRMWARE,
+               ComponentType.LIBRARY]
+    return p.add_argument('--mc-type',
+                          metavar='TYPE',
+                          help='Type of the main component'
+                               f' {{choices: {", ".join(t.value for t in choices)}}}'
+                               ' (default: %(default)s)',
+                          dest='mc_type',
+                          choices=choices,
+                          type=argparse_type4enum(ComponentType),
+                          default=ComponentType.APPLICATION)
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index f6649b48..e11c35ea 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -16,7 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
-from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional, Set, Tuple
+from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional, Tuple
 
 from . import BomBuilder
 
@@ -26,6 +26,11 @@
 
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component, ComponentType
+    from packaging.requirements import Requirement
+
+    from .utils.pep610 import PackageSource
+
+    T_AllComponents = Dict[str, Tuple['Component', Iterable[Requirement]]]
 
 
 # !!! be as lazy loading as possible, as greedy as needed
@@ -40,9 +45,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from os import name as os_name
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum
+        from .cli_common import add_argument_mc_type, add_argument_pyproject
 
         p = ArgumentParser(description='Build an SBOM from Python (virtual) environment',
                            **kwargs)
@@ -87,23 +90,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                  • Build an SBOM from Poetry environment:
                        $ %(prog)s "$(poetry env info --executable)"
                """)
-        p.add_argument('--pyproject',
-                       metavar='FILE',
-                       help="Path to the root component's `pyproject.toml` according to PEP621",
-                       dest='pyproject_file',
-                       default=None)
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_pyproject(p)
+        add_argument_mc_type(p)
         # TODO possible additional switch:
         #  `--exclude <package>` Exclude specified package from the output (multi use)
         #  `--local`        If in a virtualenv that has global access, do not list globally-installed packages.
@@ -129,16 +117,16 @@ def __call__(self, *,  # type:ignore[override]
         from os import getcwd
 
         from .utils.cdx import make_bom
+        from .utils.pyproject import pyproject2dependencies
 
         if pyproject_file is None:
             rc = None
         else:
-            from .utils.pep621 import pyproject2component, pyproject_dependencies, pyproject_load
-            from .utils.pep631 import requirement2package_name
+            from .utils.pyproject import pyproject2component, pyproject_load
             pyproject = pyproject_load(pyproject_file)
             root_c = pyproject2component(pyproject, type=mc_type)
             root_c.bom_ref.value = 'root-component'
-            root_d = set(filter(None, map(requirement2package_name, pyproject_dependencies(pyproject))))
+            root_d = pyproject2dependencies(pyproject)
             rc = (root_c, root_d)
 
         path: List[str]
@@ -154,21 +142,19 @@ def __call__(self, *,  # type:ignore[override]
         self.__add_components(bom, rc, path=path)
         return bom
 
-    def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]],
+    def __add_components(self, bom: 'Bom',
+                         rc: Optional[Tuple['Component', Iterable['Requirement']]],
                          **kwargs: Any) -> None:
         from importlib.metadata import distributions
 
-        from cyclonedx.model import Property
         from cyclonedx.model.component import Component, ComponentType
-        from packageurl import PackageURL
+        from packaging.requirements import Requirement
 
-        from . import PropertyName
         from .utils.cdx import licenses_fixup
         from .utils.packaging import metadata2extrefs, metadata2licenses
-        from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref, packagesource4dist
-        from .utils.pep631 import requirement2package_name
+        from .utils.pep610 import packagesource4dist
 
-        all_components: Dict[str, Tuple['Component', Set[str]]] = {}
+        all_components: 'T_AllComponents' = {}
         self._logger.debug('distribution context args: %r', kwargs)
         self._logger.info('discovering distributions...')
         for dist in distributions(**kwargs):
@@ -185,39 +171,10 @@ def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]
                 external_references=metadata2extrefs(dist_meta),
                 # path of dist-package on disc? naaa... a package may have multiple files/folders on disc
             )
-            packagesource = packagesource4dist(dist)
-            purl_qs = {}  # https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
-            purl_subpath = None
-            if packagesource is not None:
-                if packagesource.subdirectory:
-                    component.properties.add(Property(name=PropertyName.PackageSourceSubdirectory.value,
-                                                      value=packagesource.subdirectory))
-                    purl_subpath = packagesource.subdirectory
-                if isinstance(packagesource, PackageSourceVcs):
-                    purl_qs['vcs_url'] = f'{packagesource.vcs}+{packagesource.url}@{packagesource.commit_id}'
-                    component.properties.add(Property(name=PropertyName.PackageSourceVcsCommitId.value,
-                                                      value=packagesource.commit_id))
-                    if packagesource.requested_revision:
-                        component.properties.add(Property(name=PropertyName.PackageSourceVcsRequestedRevision.value,
-                                                          value=packagesource.requested_revision))
-                elif isinstance(packagesource, PackageSourceArchive):
-                    if '://files.pythonhosted.org/' not in packagesource.url:
-                        # skip PURL bloat, do not add implicit information
-                        purl_qs['download_url'] = packagesource.url
-                packagesource_extref = packagesource2extref(packagesource)
-                if packagesource_extref is not None:
-                    component.external_references.add(packagesource_extref)
-                del packagesource_extref
-            if packagesource is None or not packagesource.url.startswith('file://'):
-                # no purl for locals and unpublished packages
-                component.purl = PackageURL('pypi', name=dist_name, version=dist_version,
-                                            qualifiers=purl_qs, subpath=purl_subpath)
-            del dist_meta, dist_name, dist_version, packagesource, purl_qs
-
-            all_components[component.name.lower()] = (
-                component,
-                set(filter(None, map(requirement2package_name, dist.requires or ())))
-            )
+            del dist_meta, dist_name, dist_version
+            self.__component_add_extred_and_purl(component, packagesource4dist(dist))
+            all_components[component.name.lower()] = component, map(Requirement, dist.requires or ())
+
             self._logger.info('add component for package %r', component.name)
             self._logger.debug('add component: %r', component)
             bom.components.add(component)
@@ -231,13 +188,67 @@ def __add_components(self, bom: 'Bom', rc: Optional[Tuple['Component', Set[str]]
                 del root_c_existed
             all_components[root_c_lcname] = rc
             bom.metadata.component = root_c
+            self._logger.debug('root-component: %r', root_c)
+
+        self.__finalize_dependencies(bom, all_components)
+
+    def __finalize_dependencies(self, bom: 'Bom', all_components: 'T_AllComponents') -> None:
+        from cyclonedx.model import Property
+
+        from . import PropertyName
 
         for component, requires in all_components.values():
-            # we know a lot of dependencies, but here we are only interested in those that are actually installed/found
-            requires_d: Iterable[Component] = filter(None,
-                                                     map(lambda r: all_components.get(r, (None,))[0],
-                                                         requires))
-            bom.register_dependency(component, requires_d)
+            component_deps: List[Component] = []
+            for req in requires:
+                req_component: Optional[Component] = all_components.get(req.name.lower(), (None,))[0]
+                if req_component is None:
+                    continue
+                if req_component is component:
+                    # circulars are a typical thing when extras require other extras
+                    continue
+                component_deps.append(req_component)
+                req_component.properties.update(
+                    Property(
+                        name=PropertyName.PackageExtra.value,
+                        value=extra
+                    ) for extra in req.extras
+                )
+            bom.register_dependency(component, component_deps)
+
+    def __component_add_extred_and_purl(self, component: 'Component',
+                                        packagesource: Optional['PackageSource']) -> None:
+        from cyclonedx.model import Property
+        from packageurl import PackageURL
+
+        from . import PropertyName
+        from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref
+
+        purl_qs = {}  # https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
+        purl_subpath = None
+        if packagesource is not None:
+            if packagesource.subdirectory:
+                component.properties.add(Property(name=PropertyName.PackageSourceSubdirectory.value,
+                                                  value=packagesource.subdirectory))
+                purl_subpath = packagesource.subdirectory
+            if isinstance(packagesource, PackageSourceVcs):
+                purl_qs['vcs_url'] = f'{packagesource.vcs}+{packagesource.url}@{packagesource.commit_id}'
+                component.properties.add(Property(name=PropertyName.PackageSourceVcsCommitId.value,
+                                                  value=packagesource.commit_id))
+                if packagesource.requested_revision:
+                    component.properties.add(Property(name=PropertyName.PackageSourceVcsRequestedRevision.value,
+                                                      value=packagesource.requested_revision))
+            elif isinstance(packagesource, PackageSourceArchive):
+                if '://files.pythonhosted.org/' not in packagesource.url:
+                    # skip PURL bloat, do not add implicit information
+                    purl_qs['download_url'] = packagesource.url
+            packagesource_extref = packagesource2extref(packagesource)
+            if packagesource_extref is not None:
+                component.external_references.add(packagesource_extref)
+            del packagesource_extref
+        if packagesource is None or not packagesource.url.startswith('file://'):
+            # no purl for locals and unpublished packages
+            component.purl = PackageURL('pypi', name=component.name, version=component.version,
+                                        qualifiers=purl_qs, subpath=purl_subpath)
 
     @staticmethod
     def __py_interpreter(value: str) -> str:
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 6fafb4f7..9f89ec56 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -44,9 +44,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from os import getenv
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum, arpaese_split
+        from .cli_common import add_argument_mc_type, add_argument_pyproject
+        from .utils.args import arpaese_split
 
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pipenv.
@@ -62,7 +61,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        type=arpaese_split((' ', ',')),
                        default=[])
         p.add_argument('-d', '--dev',
-                       help='both develop and default packages [env var: PIPENV_DEV]',
+                       help='Analyse both develop and default packages [env var: PIPENV_DEV]',
                        action='store_true',
                        dest='dev',
                        default=getenv('PIPENV_DEV', '').lower() in ('1', 'true', 'yes', 'on'))
@@ -71,23 +70,8 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        help='Specify a PyPI mirror [env var: PIPENV_PYPI_MIRROR]',
                        dest='pypi_url',
                        default=getenv('PIPENV_PYPI_MIRROR'))
-        p.add_argument('--pyproject',
-                       metavar='FILE',
-                       help="Path to the root component's `pyproject.toml` according to PEP621",
-                       dest='pyproject_file',
-                       default=None)
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_pyproject(p)
+        add_argument_mc_type(p)
         p.add_argument('project_directory',
                        metavar='project-directory',
                        help='The project directory for Pipenv (default: current working directory)\n'
@@ -142,7 +126,7 @@ def __call__(self, *,  # type:ignore[override]
             if pyproject_file is None:
                 rc = None
             else:
-                from .utils.pep621 import pyproject_file2component
+                from .utils.pyproject import pyproject_file2component
                 rc = pyproject_file2component(pyproject_file, type=mc_type)
                 rc.bom_ref.value = 'root-component'
 
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 372b2f62..1659f483 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -28,7 +28,6 @@
     from cyclonedx.model import ExternalReference
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component, ComponentType
-    from cyclonedx.model.license import License
 
     NameDict = Dict[str, Any]
 
@@ -70,9 +69,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum
+        from .cli_common import add_argument_mc_type
 
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Poetry project.
@@ -116,18 +113,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                         dest='all_extras',
                         default=False)
         del eg
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_mc_type(p)
         p.add_argument('project_directory',
                        metavar='project-directory',
                        help='The project directory for Poetry (default: current working directory)',
@@ -232,6 +218,7 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         from . import PropertyName
         from .utils.cdx import make_bom
+        from .utils.poetry import poetry2component
 
         self._logger.debug('use_groups: %r', use_groups)
         self._logger.debug('use_extras: %r', use_extras)
@@ -240,7 +227,8 @@ def _make_bom(self, project: 'NameDict', locker: 'NameDict',
 
         po_cfg = project['tool']['poetry']
 
-        bom.metadata.component = root_c = self.__component4poetryproj(po_cfg, mc_type)
+        bom.metadata.component = root_c = poetry2component(po_cfg, type=mc_type)
+        root_c.bom_ref.value = root_c.name  # 'root-component'
         root_c.properties.update(Property(
             name=PropertyName.PackageExtra.value,
             value=extra
@@ -332,63 +320,6 @@ def _add_ld(name: str, extras: Set[str]) -> Optional['Component']:
 
         return bom
 
-    def __component4poetryproj(self, po_cfg: 'NameDict', c_type: 'ComponentType') -> 'Component':
-        from cyclonedx.factory.license import LicenseFactory
-        from cyclonedx.model.component import Component
-
-        from .utils.cdx import licenses_fixup
-        from .utils.pep621 import classifiers2licenses
-
-        licenses: List['License'] = []
-        lfac = LicenseFactory()
-        if 'classifiers' in po_cfg:
-            # https://python-poetry.org/docs/pyproject/#classifiers
-            licenses.extend(classifiers2licenses(po_cfg['classifiers'], lfac))
-        if 'license' in po_cfg:
-            # https://python-poetry.org/docs/pyproject/#license
-            licenses.append(lfac.make_from_string(po_cfg['license']))
-        del lfac
-
-        # see spec: https://python-poetry.org/docs/pyproject/
-        return Component(
-            bom_ref=str(po_cfg.get('name', 'root-component')),
-            type=c_type,
-            name=str(po_cfg.get('name', 'unnamed')),
-            version=str(po_cfg.get('version', '')) or None,
-            description=str(po_cfg.get('description', '')) or None,
-            licenses=licenses_fixup(licenses),
-            author=' | '.join(po_cfg['authors']) if 'authors' in po_cfg else None,
-            external_references=self.__extrefs4poetryproj(po_cfg)
-        )
-
-    def __extrefs4poetryproj(self, po_cfg: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
-
-        from .utils.cdx import url_label_to_ert
-
-        for ers, ert in [
-            # see https://python-poetry.org/docs/pyproject/
-            ('homepage', ExternalReferenceType.WEBSITE),
-            ('repository', ExternalReferenceType.VCS),
-            ('documentation', ExternalReferenceType.DOCUMENTATION),
-        ]:
-            try:
-                yield ExternalReference(
-                    comment=f'from poetry: {ers}',
-                    type=ert,
-                    url=XsUri(str(po_cfg[ers])))
-            except (KeyError, InvalidUriException):  # pragma: nocover
-                pass
-        for ul, ut in po_cfg.get('urls', {}).items():
-            try:
-                yield ExternalReference(
-                    comment=f'from poetry url: {ul}',
-                    type=url_label_to_ert(ul),
-                    url=XsUri(str(ut)))
-            except InvalidUriException:  # pragma: nocover
-                pass
-
     @staticmethod
     def _get_lockfile_version(locker: 'NameDict') -> Tuple[int, ...]:
         return tuple(int(v) for v in locker['metadata'].get('lock-version', '1.0').split('.'))
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index ca432e21..1b2c6dc9 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -41,9 +41,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         from argparse import OPTIONAL, ArgumentParser
         from textwrap import dedent
 
-        from cyclonedx.model.component import ComponentType
-
-        from .utils.args import argparse_type4enum
+        from .cli_common import add_argument_mc_type, add_argument_pyproject
 
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pip requirements.
@@ -83,27 +81,12 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        action='append',
                        dest='extra_index_urls',
                        default=[])
-        p.add_argument('--pyproject',
-                       metavar='FILE',
-                       help="Path to the root component's `pyproject.toml` according to PEP621",
-                       dest='pyproject_file',
-                       default=None)
-        _mc_types = [ComponentType.APPLICATION,
-                     ComponentType.FIRMWARE,
-                     ComponentType.LIBRARY]
-        p.add_argument('--mc-type',
-                       metavar='TYPE',
-                       help='Type of the main component'
-                            f' {{choices: {", ".join(t.value for t in _mc_types)}}}'
-                            ' (default: %(default)s)',
-                       dest='mc_type',
-                       choices=_mc_types,
-                       type=argparse_type4enum(ComponentType),
-                       default=ComponentType.APPLICATION)
+        add_argument_pyproject(p)
+        add_argument_mc_type(p)
         p.add_argument('requirements_file',
                        metavar='REQUIREMENTS-FILE',
-                       help='Requirements file (default: %(default)r in current working directory).\n'
-                            'May be set to "-" to read from <stdin>.',
+                       help='Path to requirements file. May be set to "-" to read from <stdin>. '
+                            '(default: %(default)r in current working directory)',
                        nargs=OPTIONAL,
                        default='requirements.txt')
         return p
@@ -129,7 +112,7 @@ def __call__(self, *,  # type:ignore[override]
         if pyproject_file is None:
             rc = None
         else:
-            from .utils.pep621 import pyproject_file2component
+            from .utils.pyproject import pyproject_file2component
             rc = pyproject_file2component(pyproject_file, type=mc_type)
             rc.bom_ref.value = 'root-component'
 
diff --git a/cyclonedx_py/_internal/utils/packaging.py b/cyclonedx_py/_internal/utils/packaging.py
index 558d9ddb..a47496bf 100644
--- a/cyclonedx_py/_internal/utils/packaging.py
+++ b/cyclonedx_py/_internal/utils/packaging.py
@@ -63,7 +63,7 @@ def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReferenc
                     comment=f'from packaging metadata: {meta_key}',
                     type=extref_typet,
                     url=XsUri(metadata[meta_key]))
-            except InvalidUriException:
+            except InvalidUriException:  # pragma: nocover
                 pass
     for label_url in metadata.get_all('Project-URL', ()):
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#project-url-multiple-use
@@ -73,5 +73,5 @@ def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReferenc
                 comment=f'from packaging metadata Project-URL: {label}',
                 type=url_label_to_ert(label),
                 url=XsUri(url.strip()))
-        except InvalidUriException:
+        except InvalidUriException:  # pragma: nocover
             pass
diff --git a/cyclonedx_py/_internal/utils/pep610.py b/cyclonedx_py/_internal/utils/pep610.py
index 2bd1f352..8e9a4ba5 100644
--- a/cyclonedx_py/_internal/utils/pep610.py
+++ b/cyclonedx_py/_internal/utils/pep610.py
@@ -139,6 +139,6 @@ def packagesource2extref(src: PackageSource) -> Optional['ExternalReference']:
                 type=ExternalReferenceType.DISTRIBUTION,
                 url=XsUri(src.url),
                 comment=f'PackageSource: Local{sdir}')
-    except InvalidUriException:
+    except InvalidUriException:  # pragma: nocover
         pass
     return None
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index c456896c..73744110 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -23,13 +23,14 @@
 See https://peps.python.org/pep-0621/
 """
 
-from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable
+from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, Iterator
 
 if TYPE_CHECKING:
     from cyclonedx.factory.license import LicenseFactory
     from cyclonedx.model import ExternalReference
     from cyclonedx.model.component import Component, ComponentType
     from cyclonedx.model.license import License
+    from packaging.requirements import Requirement
 
 
 def classifiers2licenses(classifiers: Iterable[str], lfac: 'LicenseFactory') -> Generator['License', None, None]:
@@ -43,13 +44,13 @@ def classifiers2licenses(classifiers: Iterable[str], lfac: 'LicenseFactory') ->
                               classifiers)))
 
 
-def pyproject2licenses(pyproject: Dict[str, Any], lfac: 'LicenseFactory') -> Generator['License', None, None]:
-    if 'classifiers' in pyproject:
+def project2licenses(project: Dict[str, Any], lfac: 'LicenseFactory') -> Generator['License', None, None]:
+    if 'classifiers' in project:
         # https://packaging.python.org/en/latest/specifications/pyproject-toml/#classifiers
         # https://peps.python.org/pep-0621/#classifiers
         # https://packaging.python.org/en/latest/specifications/core-metadata/#classifier-multiple-use
-        yield from classifiers2licenses(pyproject['classifiers'], lfac)
-    license = pyproject.get('license')
+        yield from classifiers2licenses(project['classifiers'], lfac)
+    license = project.get('license')
     # https://packaging.python.org/en/latest/specifications/pyproject-toml/#license
     # https://peps.python.org/pep-0621/#license
     # https://packaging.python.org/en/latest/specifications/core-metadata/#license
@@ -57,27 +58,7 @@ def pyproject2licenses(pyproject: Dict[str, Any], lfac: 'LicenseFactory') -> Gen
         yield lfac.make_from_string(license['text'])
 
 
-def pyproject2component(pyproject: Dict[str, Any], *,
-                        type: 'ComponentType') -> 'Component':
-    from cyclonedx.factory.license import LicenseFactory
-    from cyclonedx.model.component import Component
-
-    from .cdx import licenses_fixup
-
-    project = pyproject['project']
-    dynamic = project.get('dynamic', ())
-    return Component(
-        type=type,
-        name=project['name'],
-        version=project.get('version', None) if 'version' not in dynamic else None,
-        description=project.get('description', None) if 'description' not in dynamic else None,
-        licenses=licenses_fixup(pyproject2licenses(project, LicenseFactory())),
-        external_references=_project2extrefs(project),
-        # TODO add more properties according to spec
-    )
-
-
-def _project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
+def project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
     from cyclonedx.exception.model import InvalidUriException
     from cyclonedx.model import ExternalReference, XsUri
 
@@ -90,30 +71,38 @@ def _project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference',
                 comment=f'from pyproject urls: {label}',
                 type=url_label_to_ert(label),
                 url=XsUri(str(url)))
-        except InvalidUriException:
+        except InvalidUriException:  # pragma: nocover
             pass
 
 
-def pyproject_load(pyproject_file: str) -> Dict[str, Any]:
-    from .toml import toml_loads
-    try:
-        pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
-    except OSError as err:
-        raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
-    with pyproject_fh:
-        return toml_loads(pyproject_fh.read())
+def project2component(project: Dict[str, Any], *,
+                      type: 'ComponentType') -> 'Component':
+    from cyclonedx.factory.license import LicenseFactory
+    from cyclonedx.model.component import Component
 
+    from .cdx import licenses_fixup
 
-def pyproject_file2component(pyproject_file: str, *,
-                             type: 'ComponentType') -> 'Component':
-    return pyproject2component(
-        pyproject_load(pyproject_file),
-        type=type
+    dynamic = project.get('dynamic', ())
+    return Component(
+        type=type,
+        name=project['name'],
+        version=project.get('version', None) if 'version' not in dynamic else None,
+        description=project.get('description', None) if 'description' not in dynamic else None,
+        licenses=licenses_fixup(project2licenses(project, LicenseFactory())),
+        external_references=project2extrefs(project),
+        # TODO add more properties according to spec
     )
 
 
-def pyproject_dependencies(pyproject: Dict[str, Any]) -> Generator[str, None, None]:
-    project = pyproject.get('project', {})
-    yield from project.get('dependencies', ())
-    for opts in project.get('optional-dependencies', {}).values():
-        yield from opts
+def project2dependencies(project: Dict[str, Any]) -> Iterator['Requirement']:
+    from itertools import chain
+
+    from packaging.requirements import Requirement
+
+    return (
+        Requirement(dep)
+        for dep in chain(
+            project.get('dependencies', ()),
+            chain.from_iterable(project.get('optional-dependencies', {}).values())
+        )
+    )
diff --git a/cyclonedx_py/_internal/utils/pep631.py b/cyclonedx_py/_internal/utils/pep631.py
deleted file mode 100644
index a1d36f64..00000000
--- a/cyclonedx_py/_internal/utils/pep631.py
+++ /dev/null
@@ -1,29 +0,0 @@
-# This file is part of CycloneDX Python Lib
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) OWASP Foundation. All Rights Reserved.
-
-
-from typing import Optional
-
-from packaging.requirements import Requirement
-
-
-def requirement2package_name(value: str) -> Optional[str]:
-    # see https://peps.python.org/pep-0631/#implementation
-    try:
-        return Requirement(value).name
-    except Exception:
-        return None
diff --git a/cyclonedx_py/_internal/utils/poetry.py b/cyclonedx_py/_internal/utils/poetry.py
new file mode 100644
index 00000000..dc5c1c31
--- /dev/null
+++ b/cyclonedx_py/_internal/utils/poetry.py
@@ -0,0 +1,103 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+"""
+Functionality related to poetry manifest.
+
+See https://python-poetry.org/docs/pyproject/
+"""
+
+from typing import TYPE_CHECKING, Any, Dict, Generator, List
+
+if TYPE_CHECKING:
+    from cyclonedx.model import ExternalReference
+    from cyclonedx.model.component import Component, ComponentType
+    from cyclonedx.model.license import License
+    from packaging.requirements import Requirement
+
+
+def poetry2extrefs(poetry: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
+    from cyclonedx.exception.model import InvalidUriException
+    from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+
+    from .cdx import url_label_to_ert
+
+    for ers, ert in (
+        ('homepage', ExternalReferenceType.WEBSITE),
+        ('repository', ExternalReferenceType.VCS),
+        ('documentation', ExternalReferenceType.DOCUMENTATION),
+    ):
+        try:
+            yield ExternalReference(
+                comment=f'from poetry: {ers}',
+                type=ert,
+                url=XsUri(str(poetry[ers])))
+        except (KeyError, InvalidUriException):  # pragma: nocover
+            pass
+    for label, url in poetry.get('urls', {}).items():
+        try:
+            yield ExternalReference(
+                comment=f'from poetry url: {label}',
+                type=url_label_to_ert(label),
+                url=XsUri(str(url)))
+        except InvalidUriException:  # pragma: nocover
+            pass
+
+
+def poetry2component(poetry: Dict[str, Any], *, type: 'ComponentType') -> 'Component':
+    from cyclonedx.factory.license import LicenseFactory
+    from cyclonedx.model.component import Component
+
+    from .cdx import licenses_fixup
+    from .pep621 import classifiers2licenses
+
+    licenses: List['License'] = []
+    lfac = LicenseFactory()
+    if 'classifiers' in poetry:
+        licenses.extend(classifiers2licenses(poetry['classifiers'], lfac))
+    if 'license' in poetry:
+        licenses.append(lfac.make_from_string(poetry['license']))
+    del lfac
+
+    return Component(
+        type=type,
+        name=poetry['name'],
+        version=poetry.get('version'),
+        description=poetry.get('description'),
+        licenses=licenses_fixup(licenses),
+        external_references=poetry2extrefs(poetry),
+        # TODO add more properties according to spec
+    )
+
+
+def poetry2dependencies(poetry: Dict[str, Any]) -> Generator['Requirement', None, None]:
+    from itertools import chain
+
+    from packaging.requirements import Requirement
+
+    for name, spec in chain(
+        poetry.get('dependencies', {}).items(),
+        poetry.get('dev-dependencies', {}).items(),
+        chain.from_iterable(
+            group.get('dependencies', {}).items()
+            for group in poetry.get('group', {}).values()
+        )
+    ):
+        req = Requirement(name)
+        if isinstance(spec, dict) and 'extras' in spec:
+            req.extras = set(spec['extras'])
+        yield req
diff --git a/cyclonedx_py/_internal/utils/pyproject.py b/cyclonedx_py/_internal/utils/pyproject.py
index 317af77f..090ffe7d 100644
--- a/cyclonedx_py/_internal/utils/pyproject.py
+++ b/cyclonedx_py/_internal/utils/pyproject.py
@@ -1,9 +1,49 @@
 # use pyproject from pep621
 # use pyproject from poetry implementation
 
-# usage: environment may use also th pyprojevt implementation ...
-# poetry uses only poetry implementation
-# all othther use pep621
 
+from typing import TYPE_CHECKING, Any, Dict, Iterator
 
-# TODO ^^^^
+from .pep621 import project2component, project2dependencies
+from .poetry import poetry2component, poetry2dependencies
+
+if TYPE_CHECKING:  # pragma: no cover
+    from cyclonedx.model.component import Component, ComponentType
+    from packaging.requirements import Requirement
+
+
+def pyproject2component(data: Dict[str, Any], *,
+                        type: 'ComponentType') -> 'Component':
+    tool = data.get('tool', {})
+    if 'poetry' in tool:
+        return poetry2component(tool['poetry'], type=type)
+    if 'project' in data:
+        return project2component(data['project'], type=type)
+    raise ValueError('Unable to build component from pyproject')
+
+
+def pyproject_load(pyproject_file: str) -> Dict[str, Any]:
+    from .toml import toml_loads
+    try:
+        pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
+    except OSError as err:
+        raise ValueError(f'Could not open pyproject file: {pyproject_file}') from err
+    with pyproject_fh:
+        return toml_loads(pyproject_fh.read())
+
+
+def pyproject_file2component(pyproject_file: str, *,
+                             type: 'ComponentType') -> 'Component':
+    return pyproject2component(
+        pyproject_load(pyproject_file),
+        type=type
+    )
+
+
+def pyproject2dependencies(data: Dict[str, Any]) -> Iterator['Requirement']:
+    tool = data.get('tool', {})
+    if 'poetry' in tool:
+        return poetry2dependencies(tool['poetry'])
+    if 'project' in data:
+        return project2dependencies(data['project'])
+    return iter(())
diff --git a/poetry.toml b/poetry.toml
new file mode 100644
index 00000000..1865fc64
--- /dev/null
+++ b/poetry.toml
@@ -0,0 +1,6 @@
+
+[virtualenvs.options]
+system-site-packages = false
+# these are already dev-dependencies, and therefore will come as needed
+no-pip = true
+no-setuptools = true
diff --git a/pyproject.toml b/pyproject.toml
index 2971396f..cbe1c50d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -50,6 +50,7 @@ packageurl-python = ">= 0.11"
 pip-requirements-parser = "^32.0.0"
 tomli = { version = "^2.0.1", python = "<3.11" }
 chardet = "^5.1"
+packaging = "^22||^23"
 
 [tool.poetry.group.dev.dependencies]
 # pin to exact versions, if the tool/lib/plugin is process-relevant
@@ -72,8 +73,10 @@ types-toml = "^0.10.0"
 # min version required to be able to install some dependencies
 # see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
 setuptools = ">= 47.0.0"
-# `pip --python <...> install` needed fot setup/ini of test-beds
-pip = ">=22.3"
+# install` needed for setup/init of testbeds
+pip = ">=23.0"
+pipenv = ">=2023.11.5"
+poetry = "^1.7"
 
 [tool.poetry.scripts]
 cyclonedx-py = 'cyclonedx_py._internal.cli:run'
diff --git a/tests/_data/infiles/environment/editable-self/init.py b/tests/_data/infiles/environment/editable-self/init.py
old mode 100755
new mode 100644
index 5fe23576..a3a7d080
--- a/tests/_data/infiles/environment/editable-self/init.py
+++ b/tests/_data/infiles/environment/editable-self/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -12,7 +10,8 @@
 
 __all__ = ['main']
 
-env_dir = join(dirname(__file__), '.venv')
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
 
 
 def pip_install(*args: str) -> None:
@@ -24,7 +23,7 @@ def pip_install(*args: str) -> None:
         *args
     )
     print('+ ', *call)
-    check_call(call, shell=False)  # nosec:B603
+    check_call(call, cwd=this_dir, shell=False)  # nosec:B603
 
 
 def main() -> None:
diff --git a/tests/_data/infiles/environment/local/init.py b/tests/_data/infiles/environment/local/init.py
old mode 100755
new mode 100644
index 507d3995..7bfa4f1d
--- a/tests/_data/infiles/environment/local/init.py
+++ b/tests/_data/infiles/environment/local/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -12,7 +10,8 @@
 
 __all__ = ['main']
 
-env_dir = join(dirname(__file__), '.venv')
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
 
 localpackages_dir = abspath(join(dirname(__file__), '..', '..', '_helpers', 'local_pckages'))
 
@@ -26,7 +25,7 @@ def pip_install(*args: str) -> None:
         *args
     )
     print('+ ', *call)
-    check_call(call, shell=False)  # nosec:B603
+    check_call(call, cwd=this_dir, shell=False)  # nosec:B603
 
 
 def main() -> None:
diff --git a/tests/_data/infiles/environment/no-deps/init.py b/tests/_data/infiles/environment/no-deps/init.py
old mode 100755
new mode 100644
index 1f18d264..537b90ab
--- a/tests/_data/infiles/environment/no-deps/init.py
+++ b/tests/_data/infiles/environment/no-deps/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
diff --git a/tests/_data/infiles/environment/via-pipenv/Pipfile b/tests/_data/infiles/environment/via-pipenv/Pipfile
new file mode 100644
index 00000000..0df0f6a2
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/Pipfile
@@ -0,0 +1,18 @@
+[pipenv]
+sort_pipfile = true
+
+[packages]
+toml = ">=0.10.2, <0.11"
+
+[dev-packages]
+ddt = ">=1.6.0, <2"
+
+# custom catrogys/groups
+# see https://pipenv.pypa.io/en/latest/pipfile.html#package-category-groups
+
+[categoryB]
+colorama = ">=0.4.3"
+
+[groupA]
+isoduration = "==20.11.0"
+colorama = ">=0.4, <0.5"
diff --git a/tests/_data/infiles/environment/via-pipenv/Pipfile.lock b/tests/_data/infiles/environment/via-pipenv/Pipfile.lock
new file mode 100644
index 00000000..668b5145
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/Pipfile.lock
@@ -0,0 +1,99 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "89162a3ad75438bdbaf691099103dfacb02ee2d655ab1369b20abd1da4250457"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "categoryB": {
+        "colorama": {
+            "hashes": [
+                "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44",
+                "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6'",
+            "version": "==0.4.6"
+        }
+    },
+    "default": {
+        "toml": {
+            "hashes": [
+                "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b",
+                "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==0.10.2"
+        }
+    },
+    "develop": {
+        "ddt": {
+            "hashes": [
+                "sha256:a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114",
+                "sha256:d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"
+            ],
+            "index": "pypi",
+            "version": "==1.7.0"
+        }
+    },
+    "groupA": {
+        "arrow": {
+            "hashes": [
+                "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80",
+                "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==1.3.0"
+        },
+        "colorama": {
+            "hashes": [
+                "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44",
+                "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6'",
+            "version": "==0.4.6"
+        },
+        "isoduration": {
+            "hashes": [
+                "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9",
+                "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"
+            ],
+            "index": "pypi",
+            "markers": "python_version >= '3.7'",
+            "version": "==20.11.0"
+        },
+        "python-dateutil": {
+            "hashes": [
+                "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86",
+                "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==2.8.2"
+        },
+        "six": {
+            "hashes": [
+                "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926",
+                "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.16.0"
+        },
+        "types-python-dateutil": {
+            "hashes": [
+                "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b",
+                "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"
+            ],
+            "version": "==2.8.19.14"
+        }
+    }
+}
diff --git a/tests/_data/infiles/environment/via-pipenv/init.py b/tests/_data/infiles/environment/via-pipenv/init.py
new file mode 100644
index 00000000..2b89aaf1
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/init.py
@@ -0,0 +1,63 @@
+"""
+initialize this testbed.
+"""
+
+from os import environ
+from os.path import dirname, join
+from shutil import rmtree
+from subprocess import CompletedProcess, run  # nosec:B404
+from sys import executable
+from typing import Any
+
+__all__ = ['main']
+
+this_dir = dirname(__file__)
+env_dir = join(this_dir, '.venv')
+
+pipenv_env = environ.copy()
+pipenv_env['PIPENV_VENV_IN_PROJECT'] = '1'
+pipenv_env['PIPENV_IGNORE_VIRTUALENVS'] = '1'
+pipenv_env['PIPENV_NO_INHERIT'] = '1'
+pipenv_env['PIPENV_NOSPIN'] = '1'
+
+
+def pipenv_run(*args: str) -> CompletedProcess:
+    # pipenv is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pipenv',
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, cwd=this_dir, env=pipenv_env, shell=False)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
+    # pip is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'pip',
+        '--python', env_dir,
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, **kwargs, cwd=this_dir, shell=False)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def main() -> None:
+    # needed to reinit partially stripped evn
+    rmtree(env_dir, ignore_errors=True)
+
+    # the actual setuo
+    pipenv_run('install', '--deploy', '--no-site-packages')
+
+    # uninstall things that were coming with virtualenv, that were not wanted in the first place
+    pip_run('uninstall', '--require-virtualenv', '--no-input', '--yes', 'wheel', 'setuptools', 'pip')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/via-pipenv/pyproject.toml b/tests/_data/infiles/environment/via-pipenv/pyproject.toml
new file mode 100644
index 00000000..e63d70d0
--- /dev/null
+++ b/tests/_data/infiles/environment/via-pipenv/pyproject.toml
@@ -0,0 +1,42 @@
+[project]
+# https://packaging.python.org/en/latest/specifications/declaring-project-metadata/#declaring-project-metadata
+name = "via-pipenv"
+version = "0.1.0"
+description = "packages with all meta, and some deps"
+license = {text="Apache-2.0 OR MIT"}
+readme = "README.md"
+requires-python = ">=3.8"
+
+#  dynamic = [] # TODO
+
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+
+keywords = ["packaging", "pipenv", "test"]
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
+
+dependencies = [
+  'toml'
+]
+optional-dependencies = { 'foo'=['ddt'] }
+
+# entry-point = {} # TODO
+
+# gui-scripts = {} # TODO
+# scripts = {} # TODO
+
+[project.urls]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
diff --git a/tests/_data/infiles/environment/via-poetry/dummy.py b/tests/_data/infiles/environment/via-poetry/dummy.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/_data/infiles/environment/via-poetry/init.py b/tests/_data/infiles/environment/via-poetry/init.py
new file mode 100644
index 00000000..7decdf04
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/init.py
@@ -0,0 +1,38 @@
+"""
+initialize this testbed.
+"""
+
+from os import environ
+from os.path import dirname
+from subprocess import CompletedProcess, run  # nosec:B404
+from sys import executable
+
+__all__ = ['main']
+
+this_dir = dirname(__file__)
+
+
+poetry_env = environ.copy()
+poetry_env['VIRTUAL_ENV'] = ''
+
+
+def poetry_run(*args: str) -> CompletedProcess:
+    # Poetry is not API, but a CLI -- call it like that!
+    call = (
+        executable, '-m', 'poetry',
+        *args
+    )
+    print('+ ', *call)
+    res = run(call, cwd=this_dir, env=poetry_env, shell=False)  # nosec:B603
+    if res.returncode != 0:
+        raise RuntimeError('process failed')
+    return res
+
+
+def main() -> None:
+    poetry_run('install', '--no-dev', '--sync',
+               '--no-interaction', '--no-ansi')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/_data/infiles/environment/via-poetry/poetry.lock b/tests/_data/infiles/environment/via-poetry/poetry.lock
new file mode 100644
index 00000000..1798d72b
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/poetry.lock
@@ -0,0 +1,108 @@
+# This file is automatically @generated by Poetry 1.7.1 and should not be changed by hand.
+
+[[package]]
+name = "arrow"
+version = "1.3.0"
+description = "Better dates & times for Python"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "arrow-1.3.0-py3-none-any.whl", hash = "sha256:c728b120ebc00eb84e01882a6f5e7927a53960aa990ce7dd2b10f39005a67f80"},
+    {file = "arrow-1.3.0.tar.gz", hash = "sha256:d4540617648cb5f895730f1ad8c82a65f2dad0166f57b75f3ca54759c4d67a85"},
+]
+
+[package.dependencies]
+python-dateutil = ">=2.7.0"
+types-python-dateutil = ">=2.8.10"
+
+[package.extras]
+doc = ["doc8", "sphinx (>=7.0.0)", "sphinx-autobuild", "sphinx-autodoc-typehints", "sphinx_rtd_theme (>=1.3.0)"]
+test = ["dateparser (==1.*)", "pre-commit", "pytest", "pytest-cov", "pytest-mock", "pytz (==2021.1)", "simplejson (==3.*)"]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+description = "Cross-platform colored terminal text."
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
+files = [
+    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
+    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
+]
+
+[[package]]
+name = "ddt"
+version = "1.7.0"
+description = "Data-Driven/Decorated Tests"
+optional = false
+python-versions = "*"
+files = [
+    {file = "ddt-1.7.0-py2.py3-none-any.whl", hash = "sha256:a0719acde99dd32767cff64e653ef99c01ad5b042ff265f2ebecd28796ffd114"},
+    {file = "ddt-1.7.0.tar.gz", hash = "sha256:d178d115abf25a1b8327e94f85a03ef09b1d7b0ca256f6203284b024f2fc70df"},
+]
+
+[[package]]
+name = "isoduration"
+version = "20.11.0"
+description = "Operations with ISO 8601 durations"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "isoduration-20.11.0-py3-none-any.whl", hash = "sha256:b2904c2a4228c3d44f409c8ae8e2370eb21a26f7ac2ec5446df141dde3452042"},
+    {file = "isoduration-20.11.0.tar.gz", hash = "sha256:ac2f9015137935279eac671f94f89eb00584f940f5dc49462a0c4ee692ba1bd9"},
+]
+
+[package.dependencies]
+arrow = ">=0.15.0"
+
+[[package]]
+name = "python-dateutil"
+version = "2.8.2"
+description = "Extensions to the standard Python datetime module"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+files = [
+    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
+    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
+]
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "six"
+version = "1.16.0"
+description = "Python 2 and 3 compatibility utilities"
+optional = false
+python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
+    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
+]
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+description = "Python Library for Tom's Obvious, Minimal Language"
+optional = false
+python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
+files = [
+    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
+    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
+]
+
+[[package]]
+name = "types-python-dateutil"
+version = "2.8.19.14"
+description = "Typing stubs for python-dateutil"
+optional = false
+python-versions = "*"
+files = [
+    {file = "types-python-dateutil-2.8.19.14.tar.gz", hash = "sha256:1f4f10ac98bb8b16ade9dbee3518d9ace017821d94b057a425b069f834737f4b"},
+    {file = "types_python_dateutil-2.8.19.14-py3-none-any.whl", hash = "sha256:f977b8de27787639986b4e28963263fd0e5158942b3ecef91b9335c130cb1ce9"},
+]
+
+[metadata]
+lock-version = "2.0"
+python-versions = "^3.8"
+content-hash = "6d5a229d01cb18ed9d700fa82978fc270dcf6fee5187bb7b50d1f8040074445c"
diff --git a/tests/_data/infiles/environment/via-poetry/poetry.toml b/tests/_data/infiles/environment/via-poetry/poetry.toml
new file mode 100644
index 00000000..98ce2385
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/poetry.toml
@@ -0,0 +1,6 @@
+[virtualenvs]
+in-project = true
+[virtualenvs.options]
+no-pip = true
+no-setuptools = true
+system-site-packages = false
diff --git a/tests/_data/infiles/environment/via-poetry/pyproject.toml b/tests/_data/infiles/environment/via-poetry/pyproject.toml
new file mode 100644
index 00000000..223517a8
--- /dev/null
+++ b/tests/_data/infiles/environment/via-poetry/pyproject.toml
@@ -0,0 +1,51 @@
+[tool.poetry]
+## https://python-poetry.org/docs/pyproject/
+name = "via-poetry"
+license = "Apache-2.0 OR MIT"
+version = "0.1.0"
+description = "packages with all meta, and some deps"
+authors = ["Your Name <you@example.com>", "My Name"]
+maintainers = [
+  "John Smith <johnsmith@example.org>",
+  "Jane Smith <janesmith@example.org>",
+]
+homepage = "https://oss.acme.org/my-project/"
+repository = "https://oss.acme.org/my-project.git"
+documentation = "https://oss.acme.org/my-project/docs/"
+keywords = ["packaging", "poetry", "test"]
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "License :: OSI Approved :: MIT License",
+  "Classifier: Development Status :: 4 - Beta",
+  "Intended Audience :: Developers"
+]
+packages = [
+  { include = "dummy.py" }
+]
+
+[tool.poetry.urls]
+"Bug Tracker" = "https://oss.acme.org/my-project/bugs/"
+"Funding" = "https://oss.acme.org/my-project/funding/"
+"Change log" = "https://oss.acme.org/my-project/changelog/"
+
+[tool.poetry.dependencies]
+python = "^3.8"
+toml = "^0.10.2"
+
+[tool.poetry.group.dev.dependencies]
+ddt = "^1.6.0"
+
+[tool.poetry.group.groupB.dependencies]
+isoduration = "^20.10"
+
+[tool.poetry.group.groupA]
+optional = true
+
+[tool.poetry.group.groupA.dependencies]
+isoduration = "^20.11"
+colorama = "^0.4.6"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/tests/_data/infiles/environment/with-extras/init.py b/tests/_data/infiles/environment/with-extras/init.py
old mode 100755
new mode 100644
index 9f090d6a..c189c62e
--- a/tests/_data/infiles/environment/with-extras/init.py
+++ b/tests/_data/infiles/environment/with-extras/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -26,7 +24,7 @@ def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, **kwargs, shell=False)  # nosec:B603
+    res = run(call, **kwargs, cwd=this_dir, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
diff --git a/tests/_data/infiles/environment/with-urls/init.py b/tests/_data/infiles/environment/with-urls/init.py
old mode 100755
new mode 100644
index ae264e1d..a19c91ad
--- a/tests/_data/infiles/environment/with-urls/init.py
+++ b/tests/_data/infiles/environment/with-urls/init.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 initialize this testbed.
 """
@@ -8,7 +6,6 @@
 from os.path import dirname, join
 from subprocess import CompletedProcess, run  # nosec:B404
 from sys import executable
-from typing import Any
 from venv import EnvBuilder
 
 __all__ = ['main']
@@ -17,7 +14,7 @@
 env_dir = join(this_dir, '.venv')
 
 
-def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
+def pip_run(*args: str) -> CompletedProcess:
     # pip is not API, but a CLI -- call it like that!
     call = (
         executable, '-m', 'pip',
@@ -25,7 +22,7 @@ def pip_run(*args: str, **kwargs: Any) -> CompletedProcess:
         *args
     )
     print('+ ', *call)
-    res = run(call, **kwargs, shell=False)  # nosec:B603
+    res = run(call, cwd=this_dir, shell=False)  # nosec:B603
     if res.returncode != 0:
         raise RuntimeError('process failed')
     return res
diff --git a/tests/_data/infiles/pipenv/.envrc b/tests/_data/infiles/pipenv/.envrc
index 213e1725..72c4d136 100644
--- a/tests/_data/infiles/pipenv/.envrc
+++ b/tests/_data/infiles/pipenv/.envrc
@@ -1,5 +1,3 @@
 # https://pipenv.pypa.io/en/latest/configuration.html
-export PIPENV_VENV_IN_PROJECT=1
-export PIPENV_SITE_PACKAGES=0
-export PIPENV_DEV=1
-export PIPENV_NO_INHERIT=1
+export PIPENV_IGNORE_VIRTUALENVS=1
+
diff --git a/tests/_data/infiles/poetry/.envrc b/tests/_data/infiles/poetry/.envrc
deleted file mode 100644
index 381b3157..00000000
--- a/tests/_data/infiles/poetry/.envrc
+++ /dev/null
@@ -1,5 +0,0 @@
-# https://python-poetry.org/docs/configuration/#using-environment-variables
-export POETRY_VIRTUALENVS_IN_PROJECT=1
-export POETRY_VIRTUALENVS_OPTIONS_NO_PIP=1
-export POETRY_VIRTUALENVS_OPTIONS_NO_SETUPTOOLS=1
-export POETRY_VIRTUALENVS_OPTIONS_SYSTEM_SITE_PACKAGES=0
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin
new file mode 100644
index 00000000..2316393a
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin
new file mode 100644
index 00000000..31bbeab3
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.1.xml.bin
@@ -0,0 +1,22 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin
new file mode 100644
index 00000000..b834d0c1
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.json.bin
@@ -0,0 +1,99 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin
new file mode 100644
index 00000000..1efec495
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.2.xml.bin
@@ -0,0 +1,76 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin
new file mode 100644
index 00000000..96f86ca8
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.json.bin
@@ -0,0 +1,105 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin
new file mode 100644
index 00000000..91b0d73d
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.3.xml.bin
@@ -0,0 +1,79 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin
new file mode 100644
index 00000000..1fe8a128
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin
new file mode 100644
index 00000000..7717aa82
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.4.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin
new file mode 100644
index 00000000..ba06f83c
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from pyproject urls: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from pyproject urls: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from pyproject urls: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from pyproject urls: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from pyproject urls: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from pyproject urls: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-pipenv",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin
new file mode 100644
index 00000000..4e309e52
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-pipenv_1.5.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-pipenv</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from pyproject urls: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from pyproject urls: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from pyproject urls: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from pyproject urls: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from pyproject urls: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from pyproject urls: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin
new file mode 100644
index 00000000..2316393a
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.0.xml.bin
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>
+    <component type="library">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <modified>false</modified>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin
new file mode 100644
index 00000000..31bbeab3
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.1.xml.bin
@@ -0,0 +1,22 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.1" version="1">
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin
new file mode 100644
index 00000000..81fea90f
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.2.json.bin
@@ -0,0 +1,99 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.2b.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.2"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin
new file mode 100644
index 00000000..2dd144db
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.2.xml.bin
@@ -0,0 +1,76 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin
new file mode 100644
index 00000000..54a91215
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.3.json.bin
@@ -0,0 +1,105 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "name": "cyclonedx-bom",
+        "vendor": "CycloneDX",
+        "version": "thisVersion-testing"
+      },
+      {
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.3a.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin
new file mode 100644
index 00000000..a1ec9fa9
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.3.xml.bin
@@ -0,0 +1,79 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.3" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin
new file mode 100644
index 00000000..b4255d0a
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.4.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin
new file mode 100644
index 00000000..64dcc67e
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.4.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin
new file mode 100644
index 00000000..942d9e23
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.5.json.bin
@@ -0,0 +1,101 @@
+{
+  "components": [
+    {
+      "bom-ref": "toml==0.10.2",
+      "description": "Python Library for Tom's Obvious, Minimal Language",
+      "externalReferences": [
+        {
+          "comment": "from packaging metadata: Home-page",
+          "type": "website",
+          "url": "https://github.com/uiri/toml"
+        }
+      ],
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "name": "toml",
+      "purl": "pkg:pypi/toml@0.10.2",
+      "type": "library",
+      "version": "0.10.2"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "toml==0.10.2"
+      ],
+      "ref": "root-component"
+    },
+    {
+      "ref": "toml==0.10.2"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "root-component",
+      "description": "packages with all meta, and some deps",
+      "externalReferences": [
+        {
+          "comment": "from poetry: documentation",
+          "type": "documentation",
+          "url": "https://oss.acme.org/my-project/docs/"
+        },
+        {
+          "comment": "from poetry url: Bug Tracker",
+          "type": "issue-tracker",
+          "url": "https://oss.acme.org/my-project/bugs/"
+        },
+        {
+          "comment": "from poetry url: Funding",
+          "type": "other",
+          "url": "https://oss.acme.org/my-project/funding/"
+        },
+        {
+          "comment": "from poetry url: Change log",
+          "type": "release-notes",
+          "url": "https://oss.acme.org/my-project/changelog/"
+        },
+        {
+          "comment": "from poetry: repository",
+          "type": "vcs",
+          "url": "https://oss.acme.org/my-project.git"
+        },
+        {
+          "comment": "from poetry: homepage",
+          "type": "website",
+          "url": "https://oss.acme.org/my-project/"
+        }
+      ],
+      "licenses": [
+        {
+          "expression": "Apache-2.0 OR MIT"
+        }
+      ],
+      "name": "via-poetry",
+      "type": "application",
+      "version": "0.1.0"
+    },
+    "properties": [
+      {
+        "name": "cdx:reproducible",
+        "value": "true"
+      }
+    ],
+    "tools": [
+      {
+        "externalReferences": [   ],
+        "name": "cyclonedx-python-lib",
+        "vendor": "CycloneDX",
+        "version": "libVersion-testing"
+      }
+    ]
+  },
+  "version": 1,
+  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5"
+}
\ No newline at end of file
diff --git a/tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin b/tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin
new file mode 100644
index 00000000..709ba71f
--- /dev/null
+++ b/tests/_data/snapshots/environment/venv_via-poetry_1.5.xml.bin
@@ -0,0 +1,106 @@
+<?xml version="1.0" ?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.5" version="1">
+  <metadata>
+    <tools>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-bom</name>
+        <version>thisVersion-testing</version>
+        <externalReferences>
+          <reference type="build-system">
+            <url>https://github.com/CycloneDX/cyclonedx-python/actions</url>
+          </reference>
+          <reference type="distribution">
+            <url>https://pypi.org/project/cyclonedx-bom/</url>
+          </reference>
+          <reference type="documentation">
+            <url>https://cyclonedx-bom-tool.readthedocs.io/</url>
+          </reference>
+          <reference type="issue-tracker">
+            <url>https://github.com/CycloneDX/cyclonedx-python/issues</url>
+          </reference>
+          <reference type="license">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/LICENSE</url>
+          </reference>
+          <reference type="release-notes">
+            <url>https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md</url>
+          </reference>
+          <reference type="vcs">
+            <url>https://github.com/CycloneDX/cyclonedx-python</url>
+          </reference>
+          <reference type="website">
+            <url>https://github.com/CycloneDX/cyclonedx-python/#readme</url>
+          </reference>
+        </externalReferences>
+      </tool>
+      <tool>
+        <vendor>CycloneDX</vendor>
+        <name>cyclonedx-python-lib</name>
+        <version>libVersion-testing</version>
+        <externalReferences><!-- stripped --></externalReferences>
+      </tool>
+    </tools>
+    <component type="application" bom-ref="root-component">
+      <name>via-poetry</name>
+      <version>0.1.0</version>
+      <description>packages with all meta, and some deps</description>
+      <licenses>
+        <expression>Apache-2.0 OR MIT</expression>
+      </licenses>
+      <externalReferences>
+        <reference type="documentation">
+          <url>https://oss.acme.org/my-project/docs/</url>
+          <comment>from poetry: documentation</comment>
+        </reference>
+        <reference type="issue-tracker">
+          <url>https://oss.acme.org/my-project/bugs/</url>
+          <comment>from poetry url: Bug Tracker</comment>
+        </reference>
+        <reference type="other">
+          <url>https://oss.acme.org/my-project/funding/</url>
+          <comment>from poetry url: Funding</comment>
+        </reference>
+        <reference type="release-notes">
+          <url>https://oss.acme.org/my-project/changelog/</url>
+          <comment>from poetry url: Change log</comment>
+        </reference>
+        <reference type="vcs">
+          <url>https://oss.acme.org/my-project.git</url>
+          <comment>from poetry: repository</comment>
+        </reference>
+        <reference type="website">
+          <url>https://oss.acme.org/my-project/</url>
+          <comment>from poetry: homepage</comment>
+        </reference>
+      </externalReferences>
+    </component>
+    <properties>
+      <property name="cdx:reproducible">true</property>
+    </properties>
+  </metadata>
+  <components>
+    <component type="library" bom-ref="toml==0.10.2">
+      <name>toml</name>
+      <version>0.10.2</version>
+      <description>Python Library for Tom's Obvious, Minimal Language</description>
+      <licenses>
+        <license>
+          <id>MIT</id>
+        </license>
+      </licenses>
+      <purl>pkg:pypi/toml@0.10.2</purl>
+      <externalReferences>
+        <reference type="website">
+          <url>https://github.com/uiri/toml</url>
+          <comment>from packaging metadata: Home-page</comment>
+        </reference>
+      </externalReferences>
+    </component>
+  </components>
+  <dependencies>
+    <dependency ref="root-component">
+      <dependency ref="toml==0.10.2"/>
+    </dependency>
+    <dependency ref="toml==0.10.2"/>
+  </dependencies>
+</bom>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
index c719b39f..dddbc81c 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.json.bin
@@ -880,9 +880,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
index 212270c7..43608693 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.2.xml.bin
@@ -702,9 +702,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
index c2b94778..3424594d 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.json.bin
@@ -347,6 +347,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:required-extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.20.0",
       "type": "library",
       "version": "4.20.0"
@@ -880,9 +886,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
index 3df7b5ee..baedf474 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.3.xml.bin
@@ -296,6 +296,9 @@
           <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:required-extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
       <name>jsonschema-specifications</name>
@@ -705,9 +708,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
index 90a65cf5..c23c15e6 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.json.bin
@@ -347,6 +347,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:required-extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.20.0",
       "type": "library",
       "version": "4.20.0"
@@ -880,9 +886,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
index 0813104f..09d4a4ae 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.4.xml.bin
@@ -323,6 +323,9 @@
           <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:required-extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
       <name>jsonschema-specifications</name>
@@ -732,9 +735,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
index 9477ed31..0ab017d3 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.json.bin
@@ -347,6 +347,12 @@
         }
       ],
       "name": "jsonschema",
+      "properties": [
+        {
+          "name": "cdx:python:package:required-extra",
+          "value": "format"
+        }
+      ],
       "purl": "pkg:pypi/jsonschema@4.20.0",
       "type": "library",
       "version": "4.20.0"
@@ -880,9 +886,6 @@
       "ref": "arrow==1.3.0"
     },
     {
-      "dependsOn": [
-        "attrs==23.1.0"
-      ],
       "ref": "attrs==23.1.0"
     },
     {
diff --git a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
index c547b7a8..41ed6c7a 100644
--- a/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
+++ b/tests/_data/snapshots/environment/venv_with-extras_1.5.xml.bin
@@ -323,6 +323,9 @@
           <comment>from packaging metadata Project-URL: Homepage</comment>
         </reference>
       </externalReferences>
+      <properties>
+        <property name="cdx:python:package:required-extra">format</property>
+      </properties>
     </component>
     <component type="library" bom-ref="jsonschema-specifications==2023.11.2">
       <name>jsonschema-specifications</name>
@@ -732,9 +735,7 @@
       <dependency ref="python-dateutil==2.8.2"/>
       <dependency ref="types-python-dateutil==2.8.19.14"/>
     </dependency>
-    <dependency ref="attrs==23.1.0">
-      <dependency ref="attrs==23.1.0"/>
-    </dependency>
+    <dependency ref="attrs==23.1.0"/>
     <dependency ref="boolean.py==4.0"/>
     <dependency ref="cyclonedx-python-lib==6.0.0">
       <dependency ref="jsonschema==4.20.0"/>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
index 72561115..c38d1503 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
index 8fdb212f..f10cb0d6 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
index 7c9ce9ab..157f748d 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.json.bin
@@ -314,7 +314,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
index f8a0a8d5..2847e441 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
index f90b33b5..969e50b9 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.json.bin
@@ -314,7 +314,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
index 99a61427..f3a04fd6 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
index 155bcb7e..20114425 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.json.bin
@@ -314,7 +314,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
index d9515fb0..bc128733 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
index 72561115..c38d1503 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
index 8fdb212f..f10cb0d6 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
index 5e7368e1..1788c354 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
index 085224be..329d1719 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
index 7e3db0bb..ddcaaea4 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
index 6bb8b4c3..466dab8f 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
index 2a23a3b3..275831e7 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
index d2f38aca..39623a12 100644
--- a/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/group-deps_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
index 2df1f738..d954129e 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.2.json.bin
@@ -46,7 +46,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
index e4989cef..6969edfd 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
index 8b631e7f..24bb7ed6 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.3.json.bin
@@ -70,7 +70,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
index 59b1587d..fa42bfa1 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
index 22dd7272..eb087833 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.4.json.bin
@@ -70,7 +70,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
index c7fa4536..c67240de 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
index a6752f97..7f3deba0 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.5.json.bin
@@ -70,7 +70,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
index c2e27207..7a494b2a 100644
--- a/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
index eb07f486..b7e0f77a 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.2.json.bin
@@ -64,7 +64,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
index 74bdf4f8..afbd5901 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
index 799ca196..c2131420 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.3.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
index 8c5b3db8..a5b780c9 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
index 9b7c5e77..2b7e6452 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.4.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
index 26fe0e86..b8e940d9 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
index 7abf6e76..0a0a832e 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.5.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
index 7c158e6b..f8d20acc 100644
--- a/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
index eb07f486..b7e0f77a 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.2.json.bin
@@ -64,7 +64,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
index 74bdf4f8..afbd5901 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
index 799ca196..c2131420 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.3.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
index 8c5b3db8..a5b780c9 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
index 9b7c5e77..2b7e6452 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.4.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
index 26fe0e86..b8e940d9 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
index 7abf6e76..0a0a832e 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.5.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "local",
       "description": "packages from local paths",
       "name": "local",
diff --git a/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
index 7c158e6b..f8d20acc 100644
--- a/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/local_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="local">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>local</name>
       <version>0.1.0</version>
       <description>packages from local paths</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
index eeff306d..18bd3d78 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.json.bin
@@ -148,7 +148,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
index c444cea3..828f87d4 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
index 0b6c0c8f..d739394d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.json.bin
@@ -238,7 +238,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
index ceefbe21..58185519 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
index 003e0d62..743b82d3 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.json.bin
@@ -238,7 +238,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
index e084b603..881953d3 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
index 0110a1b6..5b288776 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.json.bin
@@ -238,7 +238,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
index 5218aa98..469f4989 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
index 2e43e617..f5070a62 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
index 279a3f1d..2283fa1e 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
index 6bf2d91c..0cdad807 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.json.bin
@@ -310,7 +310,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
index 8669b5f9..fe208c82 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
index dfe326a2..44cfe868 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.json.bin
@@ -310,7 +310,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
index 01af8426..398ee4cf 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
index d4336606..2544d863 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.json.bin
@@ -310,7 +310,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
index e9cfa7ff..42fb3d7d 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
index 2e43e617..f5070a62 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
index 279a3f1d..2283fa1e 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
index e38ae0d9..df5a5cca 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
index 7d0eee4d..c487f600 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
index 775514f6..64905c9f 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
index afea6987..4a30b994 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
index 809b6e0a..f6c1cd2f 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "main-and-dev",
       "description": "main and dev depenndencies",
       "name": "main-and-dev",
diff --git a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
index 16dbc8d9..6c156072 100644
--- a/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/main-and-dev_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="main-and-dev">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>main-and-dev</name>
       <version>0.1.0</version>
       <description>main and dev depenndencies</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
index 568e0c09..9a294beb 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
index 6dbbe4bb..cfe88429 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
index 647522ce..ab0aff6c 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
index 57ffb583..e02223d7 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
index 036a231d..24180782 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
index b146d784..4da28db5 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
index fab602de..4e765a34 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com> | My Name",
       "bom-ref": "no-deps",
       "description": "packages with all meta, but no deps",
       "externalReferences": [
diff --git a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
index 731a93f0..d329d28f 100644
--- a/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-deps_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="no-deps">
-      <author>Your Name &lt;you@example.com&gt; | My Name</author>
       <name>no-deps</name>
       <version>0.1.0</version>
       <description>packages with all meta, but no deps</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
index 20d926a5..c4ed24b7 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.json.bin
@@ -34,7 +34,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
index 0b4cbb8f..50e031a6 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
index b1963871..ab8c21a2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
index 862e229d..546a4a19 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
index 667fdaa3..35e48f2f 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
index 5f6bedbc..888872f2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
index f7dda794..3a00590e 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
index 69719a18..7c578aee 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
index 20d926a5..c4ed24b7 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.json.bin
@@ -34,7 +34,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
index 0b4cbb8f..50e031a6 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
index b1963871..ab8c21a2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
index 862e229d..546a4a19 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
index 667fdaa3..35e48f2f 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
index 5f6bedbc..888872f2 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
index f7dda794..3a00590e 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
index 69719a18..7c578aee 100644
--- a/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/no-dev_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
index 7ffeaf78..cb8be747 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.json.bin
@@ -136,7 +136,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
index 3edba13c..6f6fc213 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
index bdc1dcc8..3ba3db46 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.json.bin
@@ -230,7 +230,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
index c0883ed7..b756a06a 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
index 768780f6..bf42ec21 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.json.bin
@@ -230,7 +230,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
index 3cceb16c..3b4ed18c 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
index 557f3a44..54a4bf3e 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.json.bin
@@ -230,7 +230,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
index 426e4d09..c6402307 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
index 7ffeaf78..cb8be747 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.json.bin
@@ -136,7 +136,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
index 3edba13c..6f6fc213 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
index 893677fa..3200fa58 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.json.bin
@@ -202,7 +202,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
index b95ce7da..7e74e040 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
index 96529c93..576d18ad 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.json.bin
@@ -202,7 +202,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
index 4f36ca4c..77e8944b 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
index dc07211d..9b387f20 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.json.bin
@@ -202,7 +202,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
index 58279c6d..301cba77 100644
--- a/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/only-groups_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
index 074a680e..8d742ad5 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.json.bin
@@ -58,7 +58,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
index 62f6a5a8..346d9e2b 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
index a59130b5..c9dd9774 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
index 5ed17059..5a14f0aa 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
index bc52832c..c48c39c8 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
index 573cce19..ae4187ec 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
index 9b392530..cdd0b94d 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.json.bin
@@ -94,7 +94,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
index 3b7bc58f..ff2b41d4 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
index 117389e7..bfbb0ebc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.json.bin
@@ -579,7 +579,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
index bc8621a6..f80f5cc7 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
index fdab87d0..e5bb2314 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.json.bin
@@ -1149,7 +1149,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
index 8446a2cf..828dd5ef 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
index 14a81265..a3f6ba9b 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.json.bin
@@ -1149,7 +1149,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
index 2431430b..1d76c835 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
index 69c5b059..91aa48bd 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.json.bin
@@ -1149,7 +1149,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
index a5d6bb77..29c8f6ea 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
index 117389e7..bfbb0ebc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.json.bin
@@ -579,7 +579,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
index bc8621a6..f80f5cc7 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
index 30e9be4a..7d1cd297 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.json.bin
@@ -1113,7 +1113,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
index 1cbf3707..7f1ed55f 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
index 734c8b91..67dd1ef0 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.json.bin
@@ -1113,7 +1113,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
index 9824e0cc..b63cbe51 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
index 66414712..8e6f12fc 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.json.bin
@@ -1113,7 +1113,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "private-packges",
       "description": "packages from aternative package repositories",
       "name": "private-packges",
diff --git a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
index bbbf7ebc..02737f3a 100644
--- a/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/private-packges_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="private-packges">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>private-packges</name>
       <version>0.1.0</version>
       <description>packages from aternative package repositories</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
index 5b7ae2dc..048767d9 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.json.bin
@@ -34,7 +34,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
index 624e73bb..bcd40111 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
index 0a2f3a87..76ed92c9 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
index e83010ac..f7455eb5 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
index 28b52532..3b9b0c87 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
index 3e2d37c0..3dc08218 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
index 3f07b200..ba019727 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.json.bin
@@ -52,7 +52,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "regression-issue611",
       "description": "regression for issue #611",
       "name": "regression-issue611",
diff --git a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
index fe3175ff..d1c75ff8 100644
--- a/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/regression-issue611_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="regression-issue611">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>regression-issue611</name>
       <version>0.1.0</version>
       <description>regression for issue #611</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
index 04879dc8..9fa9ff65 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.json.bin
@@ -107,7 +107,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
index e20c5504..19802b19 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
index 5088af8b..b2c46da2 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.json.bin
@@ -157,7 +157,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
index fa7050b3..c244f88f 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
index a04a5d1a..9d2c8300 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.json.bin
@@ -157,7 +157,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
index cc4ba787..1f607a1b 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
index bfeaa928..913113e4 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.json.bin
@@ -157,7 +157,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
index a23f8981..44355a61 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
index 6ea5df78..f9f876b3 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.json.bin
@@ -1114,7 +1114,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
index d1cc5a31..c8224de0 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
index 8fe68cb9..c6f3eedd 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.json.bin
@@ -2104,7 +2104,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
index f72b3a59..f6bbeb3e 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
index 3cb68473..04eeeac3 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.json.bin
@@ -2104,7 +2104,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
index e44170fa..a8c170b9 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
index c37085fc..db2452cd 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.json.bin
@@ -2104,7 +2104,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
index 0c8f6a82..528baa03 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
index 91dc7cd4..2a8d2398 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.json.bin
@@ -1672,7 +1672,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
index fcdde56b..300bf5ad 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
index 6adc36ef..a6d6fd0d 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.json.bin
@@ -3150,7 +3150,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
index ac579c1f..d93b0190 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
index 4ee45fb8..6eaa1df7 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.json.bin
@@ -3150,7 +3150,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
index e5011131..30970c19 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
index 07814609..740ee9f9 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.json.bin
@@ -3150,7 +3150,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
index c4effd6e..8735804d 100644
--- a/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-extras_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
index a7300a42..e58e8a4b 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
index 34de6cf4..c84c6d15 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
index 8bae5aea..91ac068e 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.json.bin
@@ -318,7 +318,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
index af433927..6c118f5e 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
index 035b6d1c..a8029f73 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.json.bin
@@ -318,7 +318,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
index 0362fc2f..87adbbd8 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
index 74c673a4..85902458 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.json.bin
@@ -318,7 +318,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
index 370f7753..f9be05a1 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
index a7300a42..e58e8a4b 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.json.bin
@@ -184,7 +184,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
index 34de6cf4..c84c6d15 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
index 378bdc31..be2081c7 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
index a0ad8a44..9661ab11 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
index 742375a5..6b8eed0e 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
index c62a1516..2d97e3b7 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
index f13eb38d..84edcb56 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.json.bin
@@ -286,7 +286,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "group-deps",
       "description": "dependencies organized in groups",
       "name": "group-deps",
diff --git a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
index 8d3c8b2d..1ea3521a 100644
--- a/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/some-groups_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="group-deps">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>group-deps</name>
       <version>0.1.0</version>
       <description>dependencies organized in groups</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
index d16cccf9..64718d0c 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
index 274b72a8..00d95863 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
index a751b6ec..24199c42 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
index 8a925f4f..f26726dc 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
index a0628524..2666e3fa 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
index b4f8191b..0c32ddc5 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
index b1ba942b..b6a380f0 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
index d2ea971e..5df22f16 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
index d16cccf9..64718d0c 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
index 274b72a8..00d95863 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
index a751b6ec..24199c42 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
index 8a925f4f..f26726dc 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
index a0628524..2666e3fa 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
index b4f8191b..0c32ddc5 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
index b1ba942b..b6a380f0 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
index d2ea971e..5df22f16 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
index d16cccf9..64718d0c 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
index 274b72a8..00d95863 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
index a751b6ec..24199c42 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
index 8a925f4f..f26726dc 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
index a0628524..2666e3fa 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
index b4f8191b..0c32ddc5 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
index b1ba942b..b6a380f0 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.json.bin
@@ -6,7 +6,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-extras",
       "description": "depenndencies with extras",
       "name": "with-extras",
diff --git a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
index d2ea971e..5df22f16 100644
--- a/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-extras_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-extras">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-extras</name>
       <version>0.1.0</version>
       <description>depenndencies with extras</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
index 797b0a86..fdfd7f0b 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.json.bin
@@ -91,7 +91,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
index b17b4642..89c29485 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
index 4e2d86ef..14c3ba63 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.json.bin
@@ -123,7 +123,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
index ccd1a1be..28c2d00e 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
index 9ae1a00e..5a0767f9 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.json.bin
@@ -123,7 +123,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
index a45c5c08..a57c21c3 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
index d0dc7b6c..ef00a489 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.json.bin
@@ -123,7 +123,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
index e49d1d6e..0f696633 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock10_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
index 797b0a86..fdfd7f0b 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.json.bin
@@ -91,7 +91,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
index b17b4642..89c29485 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
index f3213fc0..b4d0630d 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.json.bin
@@ -131,7 +131,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
index 3011ef0d..ad79f909 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
index c6036268..daadddcc 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.json.bin
@@ -131,7 +131,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
index c56d5f70..8d5dcfb8 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
index 602b7f77..1a98f44c 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.json.bin
@@ -131,7 +131,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
index f32fabe2..8243784f 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock11_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
index 797b0a86..fdfd7f0b 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.json.bin
@@ -91,7 +91,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
index b17b4642..89c29485 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.2.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
index 217b31e8..4b7970f5 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.json.bin
@@ -143,7 +143,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
index 4d5a71a5..530aa048 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.3.xml.bin
@@ -14,7 +14,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
index 51efd3c8..9d6e60d9 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.json.bin
@@ -143,7 +143,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
index a9a79d94..e85e44d1 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.4.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
index 2204f69d..a90489ee 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.json.bin
@@ -143,7 +143,6 @@
   ],
   "metadata": {
     "component": {
-      "author": "Your Name <you@example.com>",
       "bom-ref": "with-urls",
       "description": "packages from direct urls",
       "name": "with-urls",
diff --git a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
index ad53ea7f..9c4228bb 100644
--- a/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
+++ b/tests/_data/snapshots/poetry/with-urls_lock20_1.5.xml.bin
@@ -41,7 +41,6 @@
       </tool>
     </tools>
     <component type="application" bom-ref="with-urls">
-      <author>Your Name &lt;you@example.com&gt;</author>
       <name>with-urls</name>
       <version>0.1.0</version>
       <description>packages from direct urls</description>
diff --git a/tests/integration/test_cli_environment.py b/tests/integration/test_cli_environment.py
index 6ce23b1e..2ee1c913 100644
--- a/tests/integration/test_cli_environment.py
+++ b/tests/integration/test_cli_environment.py
@@ -33,11 +33,9 @@
 from tests import INFILES_DIRECTORY, INIT_TESTBEDS, SUPPORTED_OF_SV, SnapshotMixin, make_comparable
 
 initfiles = glob(join(INFILES_DIRECTORY, 'environment', '*', 'init.py'))
-projectdirs = list(dirname(initfile) for initfile in initfiles)
-
 test_data = tuple(
     (f'{basename(projectdir)}-{sv.name}-{of.name}', projectdir, sv, of)
-    for projectdir in projectdirs
+    for projectdir in map(dirname, initfiles)
     for of, sv in SUPPORTED_OF_SV
 )
 
@@ -49,16 +47,20 @@ def test_data_file_filter(s: str) -> Generator[Any, None, None]:
 @ddt
 class TestCliEnvironment(TestCase, SnapshotMixin):
 
+    @classmethod
+    def __setup_testbeds_init(cls) -> None:
+        for initfile in initfiles:
+            print('setup init testbed:', initfile)
+            res = run((executable, initfile),
+                      capture_output=True, encoding='utf8', errors='replace', shell=False)  # nosec:B603
+            if res.returncode != 0:
+                raise RuntimeError(
+                    f'failed init: {initfile}\nstdout: {res.stdout}\nstderr: {res.stderr}\n')
+
     @classmethod
     def setUpClass(cls) -> None:
         if INIT_TESTBEDS:
-            for initfile in initfiles:
-                res = run([executable, initfile],
-                          capture_output=True, encoding='utf8', shell=False)  # nosec:B603
-                if res.returncode != 0:
-                    raise RuntimeError(f'failed init :\n'
-                                       f'stdout: {res.stdout}\n'
-                                       f'stderr: {res.stderr}\n')
+            cls.__setup_testbeds_init()
 
     @named_data(
         ('does-not-exist', 'something-that-must-not-exist.testing', 'No such file or directory'),

From d7eacedb632287c3952e582800a9528d3a1e5be2 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Sun, 24 Dec 2023 05:03:32 +0100
Subject: [PATCH 154/155] Rewrite 4 stats (#637)

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 cyclonedx_py/_internal/cli.py             | 18 +++----
 cyclonedx_py/_internal/cli_common.py      | 21 +++++++-
 cyclonedx_py/_internal/environment.py     | 62 +++++++---------------
 cyclonedx_py/_internal/pipenv.py          | 43 ++++++----------
 cyclonedx_py/_internal/poetry.py          | 63 ++++++-----------------
 cyclonedx_py/_internal/requirements.py    | 56 +++++++-------------
 cyclonedx_py/_internal/utils/packaging.py | 20 +++----
 cyclonedx_py/_internal/utils/pep610.py    |  7 ++-
 cyclonedx_py/_internal/utils/pep621.py    | 30 ++++-------
 cyclonedx_py/_internal/utils/poetry.py    | 28 ++++------
 cyclonedx_py/_internal/utils/pyproject.py |  2 +-
 11 files changed, 129 insertions(+), 221 deletions(-)

diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index cc774861..e9013691 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -15,23 +15,27 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
-
 import logging
 import sys
 from argparse import ArgumentParser, FileType, RawDescriptionHelpFormatter
+from itertools import chain
 from typing import TYPE_CHECKING, Any, Dict, List, Optional, TextIO, Type
 
+from cyclonedx.model import Property
+from cyclonedx.output import make_outputter
 from cyclonedx.schema import OutputFormat, SchemaVersion
+from cyclonedx.validation import make_schemabased_validator
 
 from .. import __version__
+from . import PropertyName
 from .environment import EnvironmentBB
 from .pipenv import PipenvBB
 from .poetry import PoetryBB
 from .requirements import RequirementsBB
+from .utils.args import argparse_type4enum, choices4enum
 
 if TYPE_CHECKING:  # pragma: no cover
     from argparse import Action
-    from logging import Logger
 
     from cyclonedx.model.bom import Bom
     from cyclonedx.model.component import Component
@@ -49,7 +53,6 @@
 class Command:
     @classmethod
     def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentParser:
-        from .utils.args import argparse_type4enum, choices4enum
         p = ArgumentParser(
             description='Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.',
             formatter_class=RawDescriptionHelpFormatter,
@@ -140,7 +143,7 @@ def _clean_kwargs(cls, kwargs: Dict[str, Any]) -> Dict[str, Any]:
         return {k: kwargs[k] for k in kwargs if k not in cls.__OWN_ARGS}
 
     def __init__(self, *,
-                 logger: 'Logger',
+                 logger: logging.Logger,
                  short_purls: bool,
                  output_format: OutputFormat,
                  schema_version: SchemaVersion,
@@ -161,8 +164,6 @@ def _shorten_purls(self, bom: 'Bom') -> bool:
         if not self._short_purls:
             return False
 
-        from itertools import chain
-
         self._logger.info('Shorting purls...')
         component: 'Component'
         for component in chain(
@@ -187,7 +188,6 @@ def _validate(self, output: str) -> bool:
 
         self._logger.info('Validating result to schema: %s/%s',
                           self._schema_version.to_version(), self._output_format.name)
-        from cyclonedx.validation import make_schemabased_validator
 
         validation_error = make_schemabased_validator(
             self._output_format,
@@ -213,10 +213,6 @@ def _write(self, output: str, outfile: TextIO) -> int:
 
     def _make_output(self, bom: 'Bom') -> str:
         self._logger.info('Serializing SBOM: %s/%s', self._schema_version.to_version(), self._output_format.name)
-        from cyclonedx.model import Property
-        from cyclonedx.output import make_outputter
-
-        from . import PropertyName
 
         if self._output_reproducible:
             bom.metadata.properties.add(Property(name=PropertyName.Reproducible.value,
diff --git a/cyclonedx_py/_internal/cli_common.py b/cyclonedx_py/_internal/cli_common.py
index 69fcd56b..474f9ba9 100644
--- a/cyclonedx_py/_internal/cli_common.py
+++ b/cyclonedx_py/_internal/cli_common.py
@@ -1,5 +1,25 @@
+# This file is part of CycloneDX Python Lib
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+
 from typing import TYPE_CHECKING
 
+from cyclonedx.model.component import ComponentType
+
 from .utils.args import argparse_type4enum
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -17,7 +37,6 @@ def add_argument_pyproject(p: 'ArgumentParser') -> 'Action':
 
 
 def add_argument_mc_type(p: 'ArgumentParser') -> 'Action':
-    from cyclonedx.model.component import ComponentType
     choices = [ComponentType.APPLICATION,
                ComponentType.FIRMWARE,
                ComponentType.LIBRARY]
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index e11c35ea..d2a95d56 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -16,37 +16,42 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+from argparse import OPTIONAL, ArgumentParser
+from importlib.metadata import distributions
+from json import loads
+from os import getcwd, name as os_name
+from os.path import exists, isdir, join
+from subprocess import run  # nosec
+from sys import path as sys_path
+from textwrap import dedent
 from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional, Tuple
 
-from . import BomBuilder
+from cyclonedx.model import Property
+from cyclonedx.model.component import Component, ComponentType
+from packageurl import PackageURL
+from packaging.requirements import Requirement
+
+from . import BomBuilder, PropertyName
+from .cli_common import add_argument_mc_type, add_argument_pyproject
+from .utils.cdx import licenses_fixup, make_bom
+from .utils.packaging import metadata2extrefs, metadata2licenses
+from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref, packagesource4dist
+from .utils.pyproject import pyproject2component, pyproject2dependencies, pyproject_load
 
 if TYPE_CHECKING:  # pragma: no cover
-    from argparse import ArgumentParser
     from logging import Logger
 
     from cyclonedx.model.bom import Bom
-    from cyclonedx.model.component import Component, ComponentType
-    from packaging.requirements import Requirement
 
     from .utils.pep610 import PackageSource
 
     T_AllComponents = Dict[str, Tuple['Component', Iterable[Requirement]]]
 
 
-# !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
-
-
 class EnvironmentBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser
-        from os import name as os_name
-        from textwrap import dedent
-
-        from .cli_common import add_argument_mc_type, add_argument_pyproject
-
         p = ArgumentParser(description='Build an SBOM from Python (virtual) environment',
                            **kwargs)
         if os_name == 'nt':
@@ -114,15 +119,9 @@ def __call__(self, *,  # type:ignore[override]
                  pyproject_file: Optional[str],
                  mc_type: 'ComponentType',
                  **__: Any) -> 'Bom':
-        from os import getcwd
-
-        from .utils.cdx import make_bom
-        from .utils.pyproject import pyproject2dependencies
-
         if pyproject_file is None:
             rc = None
         else:
-            from .utils.pyproject import pyproject2component, pyproject_load
             pyproject = pyproject_load(pyproject_file)
             root_c = pyproject2component(pyproject, type=mc_type)
             root_c.bom_ref.value = 'root-component'
@@ -133,7 +132,6 @@ def __call__(self, *,  # type:ignore[override]
         if python:
             path = self.__path4python(python)
         else:
-            from sys import path as sys_path
             path = sys_path.copy()
         if path[0] in ('', getcwd()):
             path.pop(0)
@@ -145,15 +143,6 @@ def __call__(self, *,  # type:ignore[override]
     def __add_components(self, bom: 'Bom',
                          rc: Optional[Tuple['Component', Iterable['Requirement']]],
                          **kwargs: Any) -> None:
-        from importlib.metadata import distributions
-
-        from cyclonedx.model.component import Component, ComponentType
-        from packaging.requirements import Requirement
-
-        from .utils.cdx import licenses_fixup
-        from .utils.packaging import metadata2extrefs, metadata2licenses
-        from .utils.pep610 import packagesource4dist
-
         all_components: 'T_AllComponents' = {}
         self._logger.debug('distribution context args: %r', kwargs)
         self._logger.info('discovering distributions...')
@@ -193,10 +182,6 @@ def __add_components(self, bom: 'Bom',
         self.__finalize_dependencies(bom, all_components)
 
     def __finalize_dependencies(self, bom: 'Bom', all_components: 'T_AllComponents') -> None:
-        from cyclonedx.model import Property
-
-        from . import PropertyName
-
         for component, requires in all_components.values():
             component_deps: List[Component] = []
             for req in requires:
@@ -217,12 +202,6 @@ def __finalize_dependencies(self, bom: 'Bom', all_components: 'T_AllComponents')
 
     def __component_add_extred_and_purl(self, component: 'Component',
                                         packagesource: Optional['PackageSource']) -> None:
-        from cyclonedx.model import Property
-        from packageurl import PackageURL
-
-        from . import PropertyName
-        from .utils.pep610 import PackageSourceArchive, PackageSourceVcs, packagesource2extref
-
         purl_qs = {}  # https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst
         purl_subpath = None
         if packagesource is not None:
@@ -252,7 +231,6 @@ def __component_add_extred_and_purl(self, component: 'Component',
 
     @staticmethod
     def __py_interpreter(value: str) -> str:
-        from os.path import exists, isdir, join
         if not exists(value):
             raise ValueError(f'No such file or directory: {value}')
         if isdir(value):
@@ -267,8 +245,6 @@ def __py_interpreter(value: str) -> str:
         return value
 
     def __path4python(self, python: str) -> List[str]:
-        from json import loads
-        from subprocess import run  # nosec
         cmd = self.__py_interpreter(python), '-c', 'import json,sys;json.dump(sys.path,sys.stdout)'
         self._logger.debug('fetch `path` from python interpreter cmd: %r', cmd)
         res = run(cmd, capture_output=True, encoding='utf8', shell=False)  # nosec
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 9f89ec56..14e917af 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -16,37 +16,37 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+from argparse import OPTIONAL, ArgumentParser
+from json import loads as json_loads
+from os import getenv
+from os.path import join
+from textwrap import dedent
 from typing import TYPE_CHECKING, Any, Dict, Generator, List, Optional, Set, Tuple
 
-from . import BomBuilder
+from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
+from cyclonedx.model.component import Component, ComponentType
+from packageurl import PackageURL
+
+from . import BomBuilder, PropertyName
+from .cli_common import add_argument_mc_type, add_argument_pyproject
+from .utils.args import arpaese_split
+from .utils.cdx import make_bom
+from .utils.pyproject import pyproject_file2component
 
 if TYPE_CHECKING:  # pragma: no cover
-    from argparse import ArgumentParser
     from logging import Logger
 
-    from cyclonedx.model import ExternalReference
     from cyclonedx.model.bom import Bom
-    from cyclonedx.model.component import Component, ComponentType
 
     NameDict = Dict[str, Any]
 
 
-# !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
-
-
 class PipenvBB(BomBuilder):
     __LOCKFILE_META = '_meta'
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser
-        from os import getenv
-        from textwrap import dedent
-
-        from .cli_common import add_argument_mc_type, add_argument_pyproject
-        from .utils.args import arpaese_split
-
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pipenv.
 
@@ -95,8 +95,6 @@ def __call__(self, *,  # type:ignore[override]
                  pyproject_file: Optional[str],
                  mc_type: 'ComponentType',
                  **__: Any) -> 'Bom':
-        from json import loads as json_loads
-        from os.path import join
 
         # the group-args shall mimic the ones from Pipenv, which uses (comma and/or space)-separated lists
         # values be like: 'foo bar,bazz' -> ['foo', 'bar', 'bazz']
@@ -126,7 +124,6 @@ def __call__(self, *,  # type:ignore[override]
             if pyproject_file is None:
                 rc = None
             else:
-                from .utils.pyproject import pyproject_file2component
                 rc = pyproject_file2component(pyproject_file, type=mc_type)
                 rc.bom_ref.value = 'root-component'
 
@@ -136,13 +133,6 @@ def __call__(self, *,  # type:ignore[override]
 
     def _make_bom(self, root_c: Optional['Component'],
                   locker: 'NameDict', use_groups: Set[str]) -> 'Bom':
-        from cyclonedx.model import Property
-        from cyclonedx.model.component import Component, ComponentType
-        from packageurl import PackageURL
-
-        from . import PropertyName
-        from .utils.cdx import make_bom
-
         self._logger.debug('use_groups: %r', use_groups)
 
         bom = make_bom()
@@ -226,9 +216,6 @@ def __package_vcs(self, data: 'NameDict') -> Optional[Tuple[str, str]]:
 
     def __make_extrefs(self, name: str, data: 'NameDict', source_urls: Dict[str, str]
                        ) -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
-
         hashes = (HashType.from_composite_str(package_hash)
                   for package_hash
                   in data.get('hashes', ()))
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 1659f483..64e820ca 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -16,26 +16,34 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+from argparse import OPTIONAL, ArgumentParser
 from dataclasses import dataclass
+from itertools import chain
+from os.path import join
+from re import compile as re_compile
+from textwrap import dedent
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, List, Optional, Set, Tuple
 
-from . import BomBuilder
+from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
+from cyclonedx.model.component import Component, ComponentScope
+from packageurl import PackageURL
+
+from . import BomBuilder, PropertyName
+from .cli_common import add_argument_mc_type
+from .utils.cdx import make_bom
+from .utils.poetry import poetry2component
+from .utils.toml import toml_loads
 
 if TYPE_CHECKING:  # pragma: no cover
-    from argparse import ArgumentParser
     from logging import Logger
 
-    from cyclonedx.model import ExternalReference
     from cyclonedx.model.bom import Bom
-    from cyclonedx.model.component import Component, ComponentType
+    from cyclonedx.model.component import ComponentType
 
     NameDict = Dict[str, Any]
 
 
-# !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
-
-
 @dataclass
 class _LockEntry:
     name: str
@@ -66,11 +74,6 @@ class PoetryBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser
-        from textwrap import dedent
-
-        from .cli_common import add_argument_mc_type
-
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Poetry project.
 
@@ -133,10 +136,6 @@ def __call__(self, *,  # type:ignore[override]
                  extras: List[str], all_extras: bool,
                  mc_type: 'ComponentType',
                  **__: Any) -> 'Bom':
-        from os.path import join
-
-        from .utils.toml import toml_loads
-
         pyproject_file = join(project_directory, 'pyproject.toml')
         lock_file = join(project_directory, 'poetry.lock')
         try:
@@ -211,15 +210,6 @@ def __call__(self, *,  # type:ignore[override]
     def _make_bom(self, project: 'NameDict', locker: 'NameDict',
                   use_groups: Set[str], use_extras: Set[str],
                   mc_type: 'ComponentType') -> 'Bom':
-        from itertools import chain
-        from re import compile as re_compile
-
-        from cyclonedx.model import Property
-
-        from . import PropertyName
-        from .utils.cdx import make_bom
-        from .utils.poetry import poetry2component
-
         self._logger.debug('use_groups: %r', use_groups)
         self._logger.debug('use_extras: %r', use_extras)
 
@@ -351,12 +341,6 @@ def _parse_lock(self, locker: 'NameDict') -> Generator[_LockEntry, None, None]:
     __PACKAGE_SRC_LOCAL = ['file', 'directory']
 
     def __make_component4lock(self, package: 'NameDict') -> 'Component':
-        from cyclonedx.model import Property
-        from cyclonedx.model.component import Component, ComponentScope
-        from packageurl import PackageURL
-
-        from . import PropertyName
-
         source = package['source']
         is_vcs = source.get('type') in self.__PACKAGE_SRC_VCS
         is_local = source.get('type') in self.__PACKAGE_SRC_LOCAL
@@ -428,9 +412,6 @@ def __extrefs4lock(self, package: 'NameDict') -> Generator['ExternalReference',
             yield from self.__extrefs4lock_vcs(package)
 
     def __extrefs4lock_legacy(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
-
         source_url = package['source'].get('url', 'https://pypi.org/simple')
         for file in package['files']:
             try:
@@ -445,9 +426,6 @@ def __extrefs4lock_legacy(self, package: 'NameDict') -> Generator['ExternalRefer
                 del error
 
     def __extrefs4lock_url(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
-
         try:
             yield ExternalReference(
                 comment='from url',
@@ -459,9 +437,6 @@ def __extrefs4lock_url(self, package: 'NameDict') -> Generator['ExternalReferenc
             self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
 
     def __extrefs4lock_file(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
-
         try:
             yield ExternalReference(
                 comment='from file',
@@ -473,9 +448,6 @@ def __extrefs4lock_file(self, package: 'NameDict') -> Generator['ExternalReferen
             self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
 
     def __extrefs4lock_directory(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
-
         try:
             yield ExternalReference(
                 comment='from directory',
@@ -487,9 +459,6 @@ def __extrefs4lock_directory(self, package: 'NameDict') -> Generator['ExternalRe
             self._logger.debug('skipped dist-extRef for: %r', package['name'], exc_info=error)
 
     def __extrefs4lock_vcs(self, package: 'NameDict') -> Generator['ExternalReference', None, None]:
-        from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
-
         source = package['source']
         vcs_ref = source.get('resolved_reference', source.get('reference', ''))
         try:
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 1b2c6dc9..9e61c42e 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -16,33 +16,35 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 
+from argparse import OPTIONAL, ArgumentParser
+from functools import reduce
+from os import unlink
+from textwrap import dedent
 from typing import TYPE_CHECKING, Any, Generator, List, Optional, Set
 
-from . import BomBuilder
+from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
+from cyclonedx.model.component import Component, ComponentType
+from packageurl import PackageURL
+from pip_requirements_parser import RequirementsFile  # type:ignore[import-untyped]
+
+from . import BomBuilder, PropertyName
+from .cli_common import add_argument_mc_type, add_argument_pyproject
+from .utils.cdx import make_bom
+from .utils.io import io2file
+from .utils.pyproject import pyproject_file2component
 
 if TYPE_CHECKING:  # pragma: no cover
-    from argparse import ArgumentParser
     from logging import Logger
 
-    from cyclonedx.model import HashType
     from cyclonedx.model.bom import Bom
-    from cyclonedx.model.component import Component, ComponentType
-    from pip_requirements_parser import InstallRequirement, RequirementsFile  # type:ignore[import-untyped]
-
-
-# !!! be as lazy loading as possible, as greedy as needed
-# TODO: measure with `/bin/time -v` for max resident size and see if this changes when global imports are used
+    from pip_requirements_parser import InstallRequirement
 
 
 class RequirementsBB(BomBuilder):
 
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
-        from argparse import OPTIONAL, ArgumentParser
-        from textwrap import dedent
-
-        from .cli_common import add_argument_mc_type, add_argument_pyproject
-
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pip requirements.
 
@@ -105,36 +107,26 @@ def __call__(self, *,  # type:ignore[override]
                  pyproject_file: Optional[str],
                  mc_type: 'ComponentType',
                  **__: Any) -> 'Bom':
-        from os import unlink
-
-        from pip_requirements_parser import RequirementsFile
-
         if pyproject_file is None:
             rc = None
         else:
-            from .utils.pyproject import pyproject_file2component
             rc = pyproject_file2component(pyproject_file, type=mc_type)
             rc.bom_ref.value = 'root-component'
 
         if requirements_file == '-':
-            from sys import stdin
-
-            from .utils.io import io2file
-
+            from sys import stdin  # late bind, to allow patching
             rt = io2file(stdin.buffer)
             try:
                 rf = RequirementsFile.from_file(rt, include_nested=False)
             finally:
                 unlink(rt)
-            del rt
+            del rt, stdin
         else:
             rf = RequirementsFile.from_file(requirements_file, include_nested=True)
 
         return self._make_bom(rc, rf)
 
     def _make_bom(self, root_c: Optional['Component'], rf: 'RequirementsFile') -> 'Bom':
-        from .utils.cdx import make_bom
-
         bom = make_bom()
         bom.metadata.component = root_c
         self._logger.debug('root-component: %r', root_c)
@@ -143,8 +135,6 @@ def _make_bom(self, root_c: Optional['Component'], rf: 'RequirementsFile') -> 'B
         return bom
 
     def _add_components(self, bom: 'Bom', rf: 'RequirementsFile') -> None:
-        from functools import reduce
-
         index_url = reduce(lambda c, i: i.options.get('index_url') or c, rf.options, self._index_url)
         extra_index_urls = self._extra_index_urls.union(*(
             i.options['extra_index_urls'] for i in rf.options if 'extra_index_urls' in i.options))
@@ -160,9 +150,6 @@ def _add_components(self, bom: 'Bom', rf: 'RequirementsFile') -> None:
             bom.components.add(component)
 
     def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None, None]:
-        from cyclonedx.exception.model import UnknownHashTypeException
-        from cyclonedx.model import HashType
-
         for hash in req.hash_options:
             try:
                 yield HashType.from_composite_str(hash)
@@ -172,13 +159,6 @@ def __hashes4req(self, req: 'InstallRequirement') -> Generator['HashType', None,
 
     def _make_component(self, req: 'InstallRequirement',
                         index_url: str, extra_index_urls: Set[str]) -> 'Component':
-        from cyclonedx.exception.model import InvalidUriException
-        from cyclonedx.model import ExternalReference, ExternalReferenceType, Property, XsUri
-        from cyclonedx.model.component import Component, ComponentType
-        from packageurl import PackageURL
-
-        from . import PropertyName
-
         name = req.name
         version = req.get_pinned_version or None
         hashes = list(self.__hashes4req(req))
diff --git a/cyclonedx_py/_internal/utils/packaging.py b/cyclonedx_py/_internal/utils/packaging.py
index a47496bf..c2560c1e 100644
--- a/cyclonedx_py/_internal/utils/packaging.py
+++ b/cyclonedx_py/_internal/utils/packaging.py
@@ -17,24 +17,25 @@
 
 from typing import TYPE_CHECKING, Generator, List
 
-from cyclonedx.model import ExternalReferenceType
+from cyclonedx.exception.model import InvalidUriException
+from cyclonedx.factory.license import LicenseFactory
+from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+
+from .cdx import url_label_to_ert
+from .pep621 import classifiers2licenses
 
 if TYPE_CHECKING:  # pragma: no cover
     import sys
 
+    from cyclonedx.model.license import License
+
     if sys.version_info >= (3, 10):
         from importlib.metadata import PackageMetadata
     else:
         from email.message import Message as PackageMetadata
 
-    from cyclonedx.model import ExternalReference
-    from cyclonedx.model.license import License
-
 
 def metadata2licenses(metadata: 'PackageMetadata') -> Generator['License', None, None]:
-    from cyclonedx.factory.license import LicenseFactory
-
-    from .pep621 import classifiers2licenses
     lfac = LicenseFactory()
     if 'Classifier' in metadata:
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#classifier-multiple-use
@@ -46,11 +47,6 @@ def metadata2licenses(metadata: 'PackageMetadata') -> Generator['License', None,
 
 
 def metadata2extrefs(metadata: 'PackageMetadata') -> Generator['ExternalReference', None, None]:
-    from cyclonedx.exception.model import InvalidUriException
-    from cyclonedx.model import ExternalReference, XsUri
-
-    from .cdx import url_label_to_ert
-
     for meta_key, extref_typet in (
         # see https://packaging.python.org/en/latest/specifications/core-metadata/#home-page
         ('Home-page', ExternalReferenceType.WEBSITE),
diff --git a/cyclonedx_py/_internal/utils/pep610.py b/cyclonedx_py/_internal/utils/pep610.py
index 8e9a4ba5..3824c186 100644
--- a/cyclonedx_py/_internal/utils/pep610.py
+++ b/cyclonedx_py/_internal/utils/pep610.py
@@ -27,11 +27,12 @@
 from json import JSONDecodeError, loads as json_loads
 from typing import TYPE_CHECKING, Any, Dict, Optional
 
+from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
+from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
+
 if TYPE_CHECKING:
     from importlib.metadata import Distribution
 
-    from cyclonedx.model import ExternalReference
-
 
 class PackageSource(ABC):
     @abstractmethod
@@ -114,8 +115,6 @@ def packagesource4dist(dist: 'Distribution') -> Optional[PackageSource]:
 
 
 def packagesource2extref(src: PackageSource) -> Optional['ExternalReference']:
-    from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
-    from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, XsUri
     sdir = f' (subdirectory {src.subdirectory!r})' if src.subdirectory else ''
     try:
         if isinstance(src, PackageSourceVcs):
diff --git a/cyclonedx_py/_internal/utils/pep621.py b/cyclonedx_py/_internal/utils/pep621.py
index 73744110..a449c2e4 100644
--- a/cyclonedx_py/_internal/utils/pep621.py
+++ b/cyclonedx_py/_internal/utils/pep621.py
@@ -23,18 +23,24 @@
 See https://peps.python.org/pep-0621/
 """
 
+from itertools import chain
 from typing import TYPE_CHECKING, Any, Dict, Generator, Iterable, Iterator
 
+from cyclonedx.exception.model import InvalidUriException
+from cyclonedx.factory.license import LicenseFactory
+from cyclonedx.model import ExternalReference, XsUri
+from cyclonedx.model.component import Component
+from packaging.requirements import Requirement
+
+from .cdx import licenses_fixup, url_label_to_ert
+from .license_trove_classifier import license_trove2spdx
+
 if TYPE_CHECKING:
-    from cyclonedx.factory.license import LicenseFactory
-    from cyclonedx.model import ExternalReference
-    from cyclonedx.model.component import Component, ComponentType
+    from cyclonedx.model.component import ComponentType
     from cyclonedx.model.license import License
-    from packaging.requirements import Requirement
 
 
 def classifiers2licenses(classifiers: Iterable[str], lfac: 'LicenseFactory') -> Generator['License', None, None]:
-    from .license_trove_classifier import license_trove2spdx
     yield from map(lfac.make_from_string,
                    # `lfac.make_with_id` could be a shortcut,
                    # but some SPDX ID might not (yet) be known to CDX.
@@ -59,11 +65,6 @@ def project2licenses(project: Dict[str, Any], lfac: 'LicenseFactory') -> Generat
 
 
 def project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
-    from cyclonedx.exception.model import InvalidUriException
-    from cyclonedx.model import ExternalReference, XsUri
-
-    from .cdx import url_label_to_ert
-
     # see https://packaging.python.org/en/latest/specifications/pyproject-toml/#urls
     for label, url in project.get('urls', {}).items():
         try:
@@ -77,11 +78,6 @@ def project2extrefs(project: Dict[str, Any]) -> Generator['ExternalReference', N
 
 def project2component(project: Dict[str, Any], *,
                       type: 'ComponentType') -> 'Component':
-    from cyclonedx.factory.license import LicenseFactory
-    from cyclonedx.model.component import Component
-
-    from .cdx import licenses_fixup
-
     dynamic = project.get('dynamic', ())
     return Component(
         type=type,
@@ -95,10 +91,6 @@ def project2component(project: Dict[str, Any], *,
 
 
 def project2dependencies(project: Dict[str, Any]) -> Iterator['Requirement']:
-    from itertools import chain
-
-    from packaging.requirements import Requirement
-
     return (
         Requirement(dep)
         for dep in chain(
diff --git a/cyclonedx_py/_internal/utils/poetry.py b/cyclonedx_py/_internal/utils/poetry.py
index dc5c1c31..bb955f25 100644
--- a/cyclonedx_py/_internal/utils/poetry.py
+++ b/cyclonedx_py/_internal/utils/poetry.py
@@ -21,21 +21,24 @@
 See https://python-poetry.org/docs/pyproject/
 """
 
+from itertools import chain
 from typing import TYPE_CHECKING, Any, Dict, Generator, List
 
+from cyclonedx.exception.model import InvalidUriException
+from cyclonedx.factory.license import LicenseFactory
+from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
+from cyclonedx.model.component import Component
+from packaging.requirements import Requirement
+
+from .cdx import licenses_fixup, url_label_to_ert
+from .pep621 import classifiers2licenses
+
 if TYPE_CHECKING:
-    from cyclonedx.model import ExternalReference
-    from cyclonedx.model.component import Component, ComponentType
+    from cyclonedx.model.component import ComponentType
     from cyclonedx.model.license import License
-    from packaging.requirements import Requirement
 
 
 def poetry2extrefs(poetry: Dict[str, Any]) -> Generator['ExternalReference', None, None]:
-    from cyclonedx.exception.model import InvalidUriException
-    from cyclonedx.model import ExternalReference, ExternalReferenceType, XsUri
-
-    from .cdx import url_label_to_ert
-
     for ers, ert in (
         ('homepage', ExternalReferenceType.WEBSITE),
         ('repository', ExternalReferenceType.VCS),
@@ -59,12 +62,6 @@ def poetry2extrefs(poetry: Dict[str, Any]) -> Generator['ExternalReference', Non
 
 
 def poetry2component(poetry: Dict[str, Any], *, type: 'ComponentType') -> 'Component':
-    from cyclonedx.factory.license import LicenseFactory
-    from cyclonedx.model.component import Component
-
-    from .cdx import licenses_fixup
-    from .pep621 import classifiers2licenses
-
     licenses: List['License'] = []
     lfac = LicenseFactory()
     if 'classifiers' in poetry:
@@ -85,9 +82,6 @@ def poetry2component(poetry: Dict[str, Any], *, type: 'ComponentType') -> 'Compo
 
 
 def poetry2dependencies(poetry: Dict[str, Any]) -> Generator['Requirement', None, None]:
-    from itertools import chain
-
-    from packaging.requirements import Requirement
 
     for name, spec in chain(
         poetry.get('dependencies', {}).items(),
diff --git a/cyclonedx_py/_internal/utils/pyproject.py b/cyclonedx_py/_internal/utils/pyproject.py
index 090ffe7d..f8028aac 100644
--- a/cyclonedx_py/_internal/utils/pyproject.py
+++ b/cyclonedx_py/_internal/utils/pyproject.py
@@ -6,6 +6,7 @@
 
 from .pep621 import project2component, project2dependencies
 from .poetry import poetry2component, poetry2dependencies
+from .toml import toml_loads
 
 if TYPE_CHECKING:  # pragma: no cover
     from cyclonedx.model.component import Component, ComponentType
@@ -23,7 +24,6 @@ def pyproject2component(data: Dict[str, Any], *,
 
 
 def pyproject_load(pyproject_file: str) -> Dict[str, Any]:
-    from .toml import toml_loads
     try:
         pyproject_fh = open(pyproject_file, 'rt', encoding='utf8', errors='replace')
     except OSError as err:

From e3ed3f5c3eab25d8b96a1da43117a3d7c3acf1f4 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Mon, 25 Dec 2023 15:38:29 +0100
Subject: [PATCH 155/155] Rewrite 4 docs (#638)

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 README.md                              | 110 ++---
 cyclonedx_py/__init__.py               |   6 +
 cyclonedx_py/__main__.py               |   8 +
 cyclonedx_py/_internal/cli.py          |  19 +-
 cyclonedx_py/_internal/cli_common.py   |   4 +-
 cyclonedx_py/_internal/environment.py  |   5 +-
 cyclonedx_py/_internal/pipenv.py       |  10 +-
 cyclonedx_py/_internal/poetry.py       |  12 +-
 cyclonedx_py/_internal/requirements.py |  21 +-
 docs/index.rst                         |  32 +-
 docs/install.rst                       |   6 +-
 docs/requirements.txt                  |   2 +-
 docs/support.rst                       |   9 +-
 docs/usage.rst                         | 624 +++++++++++++++----------
 14 files changed, 487 insertions(+), 381 deletions(-)

diff --git a/README.md b/README.md
index 4982cd42..dd2d62c4 100644
--- a/README.md
+++ b/README.md
@@ -18,12 +18,11 @@ for generating Software Bill of material (BOM) documents in [CycloneDX](https://
 from:
 
 * Python (virtual) environment
-* `Poetry`
-* `Pipenv`
-* `requirements`
+* `Poetry` manifest
+* `Pipenv` manifest
+* Pip's `requirements.txt` format
 * `Conda` as a Package Manager is no longer supported since version 4.
-  Try an older version(`pip install 'cyclonedx-bom<4'`).  
-  However, `conda` Python environments are fully supported.
+  However, `conda`'s Python environments are fully supported via the methods listed above.
 
 The SBOM will contain an aggregate of all your current project's dependencies, or those defined by the manifest you supply.
 
@@ -33,18 +32,15 @@ Read the full [documentation][link_rtfd] for more details.
 
 ## Installation
 
-Install this from [PyPi.org][link_pypi] using your preferred Python package manager.
+Install this from [Python Package Index (PyPI)][link_pypi] using your preferred Python package manager.
 
-Example using `pip`:
+install via one of commands:
 
 ```shell
-pip install cyclonedx-bom
-```
-
-Example using `poetry`:
-
-```shell
-poetry add cyclonedx-bom
+python -m pip install cyclonedx-bom   # install via pip
+pipx install cyclonedx-bom            # install via pipx
+poetry add cyclonedx-bom              # install via poetry
+# ... you get the hang
 ```
 
 ## Usage
@@ -52,72 +48,28 @@ poetry add cyclonedx-bom
 Call via one of commands:
 
 ```shell
-cyclonedx-py
-python3 -m cyclonedx_py
+cyclonedx-py             # call script
+python3 -m cyclonedx_py  # call python module CLI
 ```
 
 ## Basic usage
 
 ```shellSession
 $ cyclonedx-py --help
-usage: cyclonedx-py [-h] [--version] 
-                 (-c | -cj | -e | -p | -pip | -r) [-i FILE_PATH]
-                 [--format {json,xml}] [--schema-version {1.4,1.3,1.2,1.1,1.0}]
-                 [-o FILE_PATH] 
-                 [-F] [-X]
-
-CycloneDX SBOM Generator
-
-optional arguments:
-  -h, --help            show this help message and exit
-  --version             show program's version number and exit
-  -c, --conda           Build a SBOM based on the output from `conda list
-                        --explicit` or `conda list --explicit --md5`
-  -cj, --conda-json     Build a SBOM based on the output from `conda list
-                        --json`
-  -e, --e, --environment
-                        Build a SBOM based on the packages installed in your
-                        current Python environment (default)
-  -p, --p, --poetry     Build a SBOM based on a Poetry poetry.lock's contents.
-                        Use with -i to specify absolute path to a `poetry.lock`
-                        you wish to use, else we'll look for one in the
-                        current working directory.
-  -pip, --pip           Build a SBOM based on a PipEnv Pipfile.lock's
-                        contents. Use with -i to specify absolute path to a
-                        `Pipfile.lock` you wish to use, else we'll look for
-                        one in the current working directory.
-  -r, --r, --requirements
-                        Build a SBOM based on a requirements.txt's contents.
-                        Use with -i to specify absolute path to a
-                        `requirements.txt` you wish to use, else we'll look
-                        for one in the current working directory.
-  -omit OMIT, --omit OMIT
-                        Omit specified items when using Poetry or PipEnv
-                        (currently supported is dev)
-  -X                    Enable debug output
-
-Input Method:
-  Flags to determine how this tool obtains its input
-
-  -i FILE_PATH, --in-file FILE_PATH
-                        File to read input from. Use "-" to read from STDIN.
-
-SBOM Output Configuration:
-  Choose the output format and schema version
-
-  --format {json,xml}   The output format for your SBOM (default: xml)
-  --schema-version {1.4,1.3,1.2,1.1,1.0}
-                        The CycloneDX schema version for your SBOM (default:
-                        1.4)
-  -o FILE_PATH, --o FILE_PATH, --output FILE_PATH
-                        Output file path for your SBOM (set to '-' to output
-                        to STDOUT)
-  -F, --force           If outputting to a file and the stated file already
-                        exists, it will be overwritten.
-  -pb, --purl-bom-ref   Use a component's PURL for the bom-ref value, instead
-                        of a random UUID
-  --validate, --no-validate
-                        Whether validate the result before outputting
+usage: cyclonedx-py [-h] [--version] command ...
+
+Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.
+
+positional arguments:
+  command
+    environment   Build an SBOM from Python (virtual) environment
+    requirements  Build an SBOM from Pip requirements
+    pipenv        Build an SBOM from Pipenv manifest
+    poetry        Build an SBOM from Poetry project
+
+options:
+  -h, --help      show this help message and exit
+  --version       show program's version number and exit
 ```
 
 ### Advanced usage and details
@@ -128,13 +80,19 @@ See the full [documentation][link_rtfd] for advanced usage and details on input
 
 We endeavour to support all functionality for all [current actively supported Python versions](https://www.python.org/downloads/).
 However, some features may not be possible/present in older Python versions due to their lack of support.
+However, there are older versions of this tool, that support `python>=2.7`.
 
 ## Internals
 
-This tool utilizes the [CycloneDX library][cyclonedx-library] to generate the actual data structures, and serialize and validate them.  
-Validation requires [transitive optional dependencies](https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/docs/install.rst#extras).
+This tool utilizes the [CycloneDX Python library][cyclonedx-library] to generate the actual data structures, and serialize and validate them.  
 
 This tool does **not** expose any additional _public_ API or classes - all code is intended to be internal and might change without any notice during version upgrades.
+However, the CLI is stable - you may call it programmatically like:
+```python
+from sys import executable
+from subprocess import run
+run((executable, '-m', 'cyclonedx_py', '--help'))
+```
 
 ## Contributing
 
diff --git a/cyclonedx_py/__init__.py b/cyclonedx_py/__init__.py
index be8c1153..52e6824c 100644
--- a/cyclonedx_py/__init__.py
+++ b/cyclonedx_py/__init__.py
@@ -17,3 +17,9 @@
 # do not use typing here, or else `semantic_release` might have issues finding the variable
 # flake8: noqa
 __version__ = "4.0.0-alpha.0"
+
+# There is no stable/public API.
+# You may use this instead:
+#   from sys import executable
+#   from subprocess import run
+#   run((executable, '-m', 'cyclonedx_py', '--help'))
diff --git a/cyclonedx_py/__main__.py b/cyclonedx_py/__main__.py
index 6d2c51c4..b5198af0 100644
--- a/cyclonedx_py/__main__.py
+++ b/cyclonedx_py/__main__.py
@@ -13,6 +13,14 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
+__all__ = [  # type:ignore[var-annotated]
+    # There is no stable/public API.
+    # You may use this instead:
+    #   from sys import executable
+    #   from subprocess import run
+    #   run((executable, '-m', 'cyclonedx_py', '--help'))
+]
+
 from sys import exit
 
 from ._internal.cli import run as _run
diff --git a/cyclonedx_py/_internal/cli.py b/cyclonedx_py/_internal/cli.py
index e9013691..550d4eec 100644
--- a/cyclonedx_py/_internal/cli.py
+++ b/cyclonedx_py/_internal/cli.py
@@ -72,13 +72,13 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                         dest='short_purls',
                         default=False)
         op.add_argument('-o', '--outfile',
-                        metavar='FILE',
-                        help='Output file path for your SBOM (set to "-" to output to STDOUT) (default: %(default)s)',
+                        metavar='<file>',
+                        help='Output file path for your SBOM (set to "-" to output to <stdout>) (default: %(default)s)',
                         type=FileType('wt', encoding='utf8'),
                         dest='outfile',
                         default='-')
         op.add_argument('--sv', '--schema-version',
-                        metavar='VERSION',
+                        metavar='<version>',
                         help='The CycloneDX schema version for your SBOM'
                              f' {{choices: {", ".join(sorted((v.to_version() for v in SchemaVersion), reverse=True))}}}'
                              ' (default: %(default)s)',
@@ -87,7 +87,7 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
                         type=SchemaVersion.from_version,
                         default=SchemaVersion.V1_5.to_version())
         op.add_argument('--of', '--output-format',
-                        metavar='FORMAT',
+                        metavar='<format>',
                         help=f'The output format for your SBOM {choices4enum(OutputFormat)} (default: %(default)s)',
                         dest='output_format',
                         choices=OutputFormat,
@@ -136,7 +136,12 @@ def make_argument_parser(cls, sco: ArgumentParser, **kwargs: Any) -> ArgumentPar
 
         return p
 
-    __OWN_ARGS = {'outfile', 'schema_version', 'output_format', 'reproducible', 'validate'}
+    __OWN_ARGS = {
+        # the ars keywords from __init__
+        'logger', 'short_purls', 'output_format', 'schema_version', 'output_reproducible', 'should_validate',
+        # the ars keywords from __call__
+        'outfile'
+    }
 
     @classmethod
     def _clean_kwargs(cls, kwargs: Dict[str, Any]) -> Dict[str, Any]:
@@ -167,7 +172,7 @@ def _shorten_purls(self, bom: 'Bom') -> bool:
         self._logger.info('Shorting purls...')
         component: 'Component'
         for component in chain(
-            bom.metadata.component.get_all_nested_components(True) if bom.metadata.component else [],
+            bom.metadata.component.get_all_nested_components(True) if bom.metadata.component else (),
             chain.from_iterable(
                 component.get_all_nested_components(True) for component in bom.components
             )
@@ -178,6 +183,8 @@ def _shorten_purls(self, bom: 'Bom') -> bool:
                     namespace=component.purl.namespace,  # type:ignore[arg-type]
                     name=component.purl.name,  # type:ignore[arg-type]
                     version=component.purl.version  # type:ignore[arg-type]
+                    # omit qualifiers
+                    # omit subdirectory
                 )
         return True
 
diff --git a/cyclonedx_py/_internal/cli_common.py b/cyclonedx_py/_internal/cli_common.py
index 474f9ba9..ef52d0df 100644
--- a/cyclonedx_py/_internal/cli_common.py
+++ b/cyclonedx_py/_internal/cli_common.py
@@ -28,7 +28,7 @@
 
 def add_argument_pyproject(p: 'ArgumentParser') -> 'Action':
     return p.add_argument('--pyproject',
-                          metavar='FILE',
+                          metavar='<file>',
                           help="Path to the root component's `pyproject.toml` file. "
                                'This should point to a file compliant with PEP 621 '
                                '(storing project metadata).',
@@ -41,7 +41,7 @@ def add_argument_mc_type(p: 'ArgumentParser') -> 'Action':
                ComponentType.FIRMWARE,
                ComponentType.LIBRARY]
     return p.add_argument('--mc-type',
-                          metavar='TYPE',
+                          metavar='<type>',
                           help='Type of the main component'
                                f' {{choices: {", ".join(t.value for t in choices)}}}'
                                ' (default: %(default)s)',
diff --git a/cyclonedx_py/_internal/environment.py b/cyclonedx_py/_internal/environment.py
index d2a95d56..039762cd 100644
--- a/cyclonedx_py/_internal/environment.py
+++ b/cyclonedx_py/_internal/environment.py
@@ -55,19 +55,18 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         p = ArgumentParser(description='Build an SBOM from Python (virtual) environment',
                            **kwargs)
         if os_name == 'nt':
-            # TODO the Windows help-page might need improvement.
             p.epilog = dedent("""\
                Example Usage:
                  • Build an SBOM from current python environment:
                        > %(prog)s
                  • Build an SBOM from a Python (virtual) environment:
                        > %(prog)s "...some\\path\\bin\\python.exe"
-                       > %(prog)s '...some\\path\\.venv\\'
+                       > %(prog)s "...some\\path\\.venv\\"
                  • Build an SBOM from specific Python environment:
                        > where.exe python3.9.exe
                        > %(prog)s "%%path to specific python%%"
                  • Build an SBOM from conda Python environment:
-                       > conda run where python
+                       > conda.exe run where.exe python
                        > %(prog)s "%%path to conda python%%"
                  • Build an SBOM from Pipenv environment:
                        > pipenv.exe --py
diff --git a/cyclonedx_py/_internal/pipenv.py b/cyclonedx_py/_internal/pipenv.py
index 14e917af..b99e4299 100644
--- a/cyclonedx_py/_internal/pipenv.py
+++ b/cyclonedx_py/_internal/pipenv.py
@@ -48,15 +48,15 @@ class PipenvBB(BomBuilder):
     @staticmethod
     def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         p = ArgumentParser(description=dedent("""\
-                           Build an SBOM from Pipenv.
+                           Build an SBOM from Pipenv manifest.
 
-                           The options mimic the respective ones from Pipenv.
+                           The options and switches mimic the respective ones from Pipenv CLI.
                            """),
                            **kwargs)
-        # the args shall mimic the ones from Pipenv
+        # the options and switches SHALL mimic the ones from Pipenv
         # see also: https://pipenv.pypa.io/en/latest/configuration.html
         p.add_argument('--categories',
-                       metavar='CATEGORIES',
+                       metavar='<categories>',
                        dest='categories',
                        type=arpaese_split((' ', ',')),
                        default=[])
@@ -66,7 +66,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        dest='dev',
                        default=getenv('PIPENV_DEV', '').lower() in ('1', 'true', 'yes', 'on'))
         p.add_argument('--pypi-mirror',
-                       metavar='URL',
+                       metavar='<url>',
                        help='Specify a PyPI mirror [env var: PIPENV_PYPI_MIRROR]',
                        dest='pypi_url',
                        default=getenv('PIPENV_PYPI_MIRROR'))
diff --git a/cyclonedx_py/_internal/poetry.py b/cyclonedx_py/_internal/poetry.py
index 64e820ca..eabecd40 100644
--- a/cyclonedx_py/_internal/poetry.py
+++ b/cyclonedx_py/_internal/poetry.py
@@ -77,24 +77,24 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Poetry project.
 
-                           The options mimic the respective ones from Poetry.
+                           The options and switches mimic the respective ones from Poetry CLI.
                            """),
                            **kwargs)
-        # the args shall mimic the ones from Poetry, which uses comma-separated lists and multi-use
+        # the options and switches SHALL mimic the ones from Poetry, which uses comma-separated lists and multi-use
         p.add_argument('--without',
-                       metavar='GROUPS',
+                       metavar='<groups>>',
                        help='The dependency groups to ignore (multiple values allowed)',
                        action='append',
                        dest='groups_without',
                        default=[])
         p.add_argument('--with',
-                       metavar='GROUPS',
+                       metavar='<groups>>',
                        help='The optional dependency groups to include (multiple values allowed)',
                        action='append',
                        dest='groups_with',
                        default=[])
         p.add_argument('--only',
-                       metavar='GROUPS',
+                       metavar='<groups>>',
                        help='The only dependency groups to include (multiple values allowed)',
                        action='append',
                        dest='groups_only',
@@ -105,7 +105,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                        action='store_true')
         eg = p.add_mutually_exclusive_group()
         eg.add_argument('-E', '--extras',
-                        metavar='EXTRAS',
+                        metavar='<extras>>',
                         help='Extra sets of dependencies to include (multiple values allowed)',
                         action='append',
                         dest='extras',
diff --git a/cyclonedx_py/_internal/requirements.py b/cyclonedx_py/_internal/requirements.py
index 9e61c42e..c5330702 100644
--- a/cyclonedx_py/_internal/requirements.py
+++ b/cyclonedx_py/_internal/requirements.py
@@ -48,7 +48,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         p = ArgumentParser(description=dedent("""\
                            Build an SBOM from Pip requirements.
 
-                           The options mimic the respective ones from Pip.
+                           The options and switches mimic the respective ones from Pip CLI.
                            """),
                            epilog=dedent("""\
                            Example Usage:
@@ -61,23 +61,24 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
                              • Build an inventory for all installed packages in a conda environment:
                                    $ conda run python -m pip freeze --all | %(prog)s -
                              • Build an inventory for installed packages in a Python (virtual) environment:
-                                   $ .../.venv/bin/python -m pip freeze --all --local --require-virtualenv | %(prog)s -
+                                   $ .../.venv/bin/python -m pip freeze --all --local --require-virtualenv |\\
+                                     %(prog)s -
                              • Build an inventory from an unfrozen manifest:
                                    $ python -m pip install -r dependencies.txt &&\\
                                      python -m pip freeze | %(prog)s -
                            """),
                            **kwargs)
-        # the args shall mimic the ones from Pip
+        # the options and switches SHALL mimic the ones from Pip
         p.add_argument('-i', '--index-url',
-                       metavar='URL',
-                       help='Base URL of the Python Package Index'
-                            ' (default: %(default)s) '
-                            ' This should point to a repository compliant with PEP 503 (the simple repository API)'
-                            ' or a local directory laid out in the same format.',
+                       metavar='<url>',
+                       help='Base URL of the Python Package Index. '
+                            'This should point to a repository compliant with PEP 503 (the simple repository API) '
+                            'or a local directory laid out in the same format. '
+                            '(default: %(default)s)',
                        dest='index_url',
                        default='https://pypi.org/simple')
         p.add_argument('--extra-index-url',
-                       metavar='URL',
+                       metavar='<url>',
                        help='Extra URLs of package indexes to use in addition to --index-url.'
                             ' Should follow the same rules as --index-url',
                        action='append',
@@ -86,7 +87,7 @@ def make_argument_parser(**kwargs: Any) -> 'ArgumentParser':
         add_argument_pyproject(p)
         add_argument_mc_type(p)
         p.add_argument('requirements_file',
-                       metavar='REQUIREMENTS-FILE',
+                       metavar='<requirements-file>',
                        help='Path to requirements file. May be set to "-" to read from <stdin>. '
                             '(default: %(default)r in current working directory)',
                        nargs=OPTIONAL,
diff --git a/docs/index.rst b/docs/index.rst
index 69a03a2a..5d34a819 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -12,20 +12,29 @@
    #
    # SPDX-License-Identifier: Apache-2.0
 
-CycloneDX SBOM Generation Tool
-====================================================
+CycloneDX SBOM Generation Tool for Python
+=========================================
 
-This project provides a runnable Python-based application for generating `CycloneDX`_ bill-of-material documents from
-either:
+This project provides a runnable Python-based application
+for generating Software Bill of material (SBOM) documents in `CycloneDX`_ format
+from:
 
-* Your current Python Environment
-* Your project's manifest (e.g. ``Pipfile.lock``, ``poetry.lock`` or ``requirements.txt``)
-* Conda as a Package Manager
+* Python (virtual) environment
+* `Poetry`_ manifest
+* `Pipenv`_ manifest
+* Pip's `requirements file format`_ format
+* `Conda`_ as a Package Manager is no longer supported since version 4.
+  However, ``conda``'s Python environments are fully supported via the methods listed above.
 
-The SBOM will contain an aggregate of all your current project's dependencies, or those defined by the manifest you
-supply.
+The SBOM will contain an aggregate of all your project's dependencies, or those defined by the manifest you supply.
 
-`CycloneDX`_ is a lightweight BOM specification that is easily created, human-readable, and simple to parse.
+`CycloneDX`_ is a full-stack SBOM specification that is easily created, human-readable, and simple to parse.
+
+.. _CycloneDX: https://cyclonedx.org/
+.. _Poetry: https://python-poetry.org/
+.. _Pipenv: https://pipenv.pypa.io/
+.. _requirements file format: https://pip.pypa.io/en/stable/reference/requirements-file-format/
+.. _conda: https://conda.io/
 
 .. toctree::
    :maxdepth: 2
@@ -35,6 +44,3 @@ supply.
    usage
    support
    changelog
-
-
-.. _CycloneDX: https://cyclonedx.org/
\ No newline at end of file
diff --git a/docs/install.rst b/docs/install.rst
index 2211ca5a..a84d3dfd 100644
--- a/docs/install.rst
+++ b/docs/install.rst
@@ -5,4 +5,8 @@ Install from pypi.org as you would any other Python module using your preferred
 
 .. code-block:: sh
 
-    pip install cyclonedx-bom
+   python -m pip install cyclonedx-bom   # install via pip
+   pipx install cyclonedx-bom            # install via pipx
+   poetry add cyclonedx-bom              # install via poetry
+
+   # ... you get the hang
diff --git a/docs/requirements.txt b/docs/requirements.txt
index eafdb491..ca4ca769 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,4 +1,4 @@
 m2r2>=0.3.2
 sphinx>=7.2.6,<8
 #sphinx-autoapi>=3.0.0,<4
-sphinx-rtd-theme>=1.3.0,<2
+sphinx-rtd-theme>=2.0.0,<3
diff --git a/docs/support.rst b/docs/support.rst
index 32a9d44e..bcb589f5 100644
--- a/docs/support.rst
+++ b/docs/support.rst
@@ -4,8 +4,8 @@ Support
 If you run into issues utilising this library, please raise a `GitHub Issue`_. When raising an issue please include as
 much detail as possible including:
 
-* Version ``cyclonedx-bom`` you have installed
-* Input(s)
+* Version ``cyclonedx-bom`` you have installed. fetch via ``python -m cyclonedx_py --version``.
+* Input(s) you used, as well as command line options and switches
 * Expected Output(s)
 * Actual Output(s)
 
@@ -13,9 +13,8 @@ Python Version Support
 ======================
 
 We endeavour to support all functionality for all `current actively supported Python versions`_.
-However, some features may not be possible/present in older Python versions due to their lack of support - which are
-noted below.
+However, some features may not be possible/present in older Python versions due to their lack of support.
 
 
 .. _GitHub Issue: https://github.com/CycloneDX/cyclonedx-python/issues
-.. _current actively supported Python versions: https://www.python.org/downloads/
\ No newline at end of file
+.. _current actively supported Python versions: https://www.python.org/downloads/
diff --git a/docs/usage.rst b/docs/usage.rst
index 57cc0e86..d996d3fb 100644
--- a/docs/usage.rst
+++ b/docs/usage.rst
@@ -1,332 +1,450 @@
 Usage
-=======
+=====
 
-Command Line Usage
-------------------
+Once installed, you can call the tool's command line interface via the following methods:
 
-Once installed, you can call the tool via the following methods:
+.. code-block:: shell
 
-.. code-block:: shell-session
+    cyclonedx-py             # call script
+    python3 -m cyclonedx_py  # call python module CLI
 
-    $ python3 -m cyclonedx_py
-    $ cyclonedx-py
 
 The full documentation can be issued by running with ``--help``:
 
 .. code-block:: shell-session
 
     $ cyclonedx-py --help
-    usage: cyclonedx-py [-h] (-c | -cj | -e | -p | -pip | -r) [-i FILE_PATH]
-                     [--format {json,xml}] [--schema-version {1.4,1.3,1.2,1.1,1.0}]
-                     [-o FILE_PATH] [-F] [-X]
+    usage: cyclonedx-py [-h] [--version] command ...
+
+    Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and environments.
+
+    positional arguments:
+      command
+        environment   Build an SBOM from Python (virtual) environment
+        requirements  Build an SBOM from Pip requirements
+        pipenv        Build an SBOM from Pipenv manifest
+        poetry        Build an SBOM from Poetry project
+
+    options:
+      -h, --help      show this help message and exit
+      --version       show program's version number and exit
+
+
+For Python (virtual) environment
+--------------------------------
+
+.. TODO: describe what an environment is...
+
+This will produce the most accurate and complete CycloneDX BOM as it analyses the actually installed packages.
+It will include all transitive dependencies required by the packages, as well as their properties.
+
+When using *Environment* as the source, any license information available from the installed packages will also be
+included in the generated CycloneDX BOM.
+
+The full documentation can be issued by running with ``--help``:
+
+.. code-block:: shell-session
+
+    $ cyclonedx-py environment --help
+    usage: cyclonedx-py environment [-h] [-v]
+                                    [--short-PURLs] [--output-reproducible]
+                                    [--validate | --no-validate]
+                                    [-o <file>] [--sv <version>] [--of <format>]
+                                    [--pyproject <file>] [--mc-type <type>]
+                                    [python]
 
-    CycloneDX SBOM Generator
+    Build an SBOM from Python (virtual) environment
 
-    optional arguments:
+    positional arguments:
+      python                Python interpreter
+
+    options:
       -h, --help            show this help message and exit
-      -c, --conda           Build a SBOM based on the output from `conda list
-                            --explicit` or `conda list --explicit --md5`
-      -cj, --conda-json     Build a SBOM based on the output from `conda list
-                            --json`
-      -e, --e, --environment
-                            Build a SBOM based on the packages installed in your
-                            current Python environment (default)
-      -p, --p, --poetry     Build a SBOM based on a Poetry poetry.lock's contents.
-                            Use with -i to specify absolute path to a `poetry.lock`
-                            you wish to use, else we'll look for one in the
-                            current working directory.
-      -pip, --pip           Build a SBOM based on a PipEnv Pipfile.lock's
-                            contents. Use with -i to specify absolute path to a
-                            `Pipfile.lock` you wish to use, else we'll look for
-                            one in the current working directory.
-      -r, --r, --requirements
-                            Build a SBOM based on a requirements.txt's contents.
-                            Use with -i to specify absolute path to a
-                            `requirements.txt` you wish to use, else we'll look
-                            for one in the current working directory.
-      --omit OMIT
-                            Omit specified items when using Poetry or PipEnv
-                            (currently supported is dev)
-      -X                    Enable debug output
-
-    Input Method:
-      Flags to determine how this tool obtains its input
-
-      -i FILE_PATH, --in-file FILE_PATH
-                            File to read input from, or STDIN if not specified
-
-    SBOM Output Configuration:
-      Choose the output format and schema version
-
-      --format {json,xml}   The output format for your SBOM (default: xml)
-      --schema-version {1.4,1.3,1.2,1.1,1.0}
-                            The CycloneDX schema version for your SBOM (default:
-                            1.3)
-      -o FILE_PATH, --o FILE_PATH, --output FILE_PATH
-                            Output file path for your SBOM (set to '-' to output
-                            to STDOUT)
-      -F, --force           If outputting to a file and the stated file already
-                            exists, it will be overwritten.
+      --pyproject <file>    Path to the root component's `pyproject.toml` file.
+                            This should point to a file compliant with PEP 621 (storing project metadata).
+      --mc-type <type>      Type of the main component
+                            {choices: application, firmware, library}
+                            (default: ComponentType.APPLICATION)
+      --short-PURLs         Omit all qualifiers from PackageURLs.
+                            This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.
+      -o <file>, --outfile <file>
+                            Output file path for your SBOM
+                            (set to "-" to output to STDOUT)
+                            (default: -)
+      --sv <version>, --schema-version <version>
+                            The CycloneDX schema version for your SBOM
+                            {choices: 1.5, 1.4, 1.3, 1.2, 1.1, 1.0}
+                            (default: 1.5)
+      --of <format>, --output-format <format>
+                            The output format for your SBOM
+                            {choices: JSON, XML}
+                            (default: JSON)
+      --output-reproducible
+                            Whether to go the extra mile and make the output reproducible.
+                            This might result in loss of time- and random-based-values.
       --validate, --no-validate
                             Whether validate the result before outputting
+                            (default: True)
+      -v, --verbose         Increase the verbosity of messages
+                            (multiple for more effect)
+                            (default: silent)
 
 
-From your current Python Environment
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Examples for macOS/Linux and alike
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-This will produce the most accurate and complete CycloneDX BOM as it will include all transitive dependencies required
-by the packages defined in your project's manifest (think ``requirements.txt``).
+.. code-block:: shell-session
+   :caption: Build an SBOM from current python environment
 
-When using *Environment* as the source, any license information available from the installed packages will also be
-included in the generated CycloneDX BOM.
+    $ cyclonedx-py environment
 
-Simply run:
+.. code-block:: shell-session
+   :caption: Build an SBOM from a Python (virtual) environment
 
-.. code-block:: sh
+   $ cyclonedx-py environment '...some/path/bin/python'
+   $ cyclonedx-py environment '.../.venv/'
 
-    cyclonedx-py -e -o -
+.. code-block:: shell-session
+   :caption: Build an SBOM from specific Python environment
 
+   $ cyclonedx-py environment "$(which python3.9)"
 
-This will generate a CycloneDX including all packages installed in your current Python environment and output to STDOUT
-in XML using the default schema version ``1.4`` by default.
+.. code-block:: shell-session
+   :caption: Build an SBOM from conda Python environment
 
-From your Python application manifest
+   $ cyclonedx-py environment "$(conda run which python)"
 
-.. note::
 
-    Manifest scanning limits the amount of information available. Each manifest type contains different information
-    but all are significantly less complete than scanning your actual Python Environment.
+.. code-block:: shell-session
+   :caption: Build an SBOM from Pipenv environment
 
+   $ cyclonedx-py environment "$(pipenv --py)"
+   $ cyclonedx-py environment "$(pipenv --venv)"
 
-**Conda**
+.. code-block:: shell-session
+   :caption: Build an SBOM from Poetry environment
 
-We support parsing output from Conda in various formats:
+   $ cyclonedx-py environment "$(poetry env info --executable)"
 
-* Explict output (run ``conda list --explicit`` or ``conda list --explicit --md5``)
-* JSON output (run ``conda list --json``)
 
-As example:
+Examples for Windows
+~~~~~~~~~~~~~~~~~~~~
 
-.. code-block:: sh
+.. code-block:: doscon
+   :caption: Build an SBOM from current python environment
 
-    conda list --explicit --md5 | cyclonedx-py -c -o cyclonedx.xml
+   > cyclonedx-py
 
-**Poetry**
+.. code-block:: doscon
+   :caption: Build an SBOM from a Python (virtual) environment
 
-We support parsing your ``poetry.lock`` file which should be committed along with your ``pyproject.toml`` and details
-exact pinned versions.
+   > cyclonedx-py "...some\\path\\bin\\python.exe"
+   > cyclonedx-py "...some\\path\\.venv\\"
 
-You can then run ``cyclonedx-py`` as follows:
+.. code-block:: doscon
+   :caption: Build an SBOM from specific Python environment
 
-.. code-block:: sh
+   > where.exe python3.9.exe
+   > cyclonedx-py "%%path to specific python%%"
 
-    cyclonedx-py -p -i PATH/TO/poetry.lock -o sbom.xml
+.. code-block:: doscon
+   :caption: Build an SBOM from conda Python environment
 
+   > conda.exe run where.exe python
+   > cyclonedx-py "%%path to conda python%%"
 
-If your ``poetry.lock`` is in the current working directory, you can also shorten this to:
+.. code-block:: doscon
+   :caption: Build an SBOM from Pipenv environment
 
-.. code-block:: sh
+   > pipenv.exe --py
+   > pipenv.exe --venv
+   > cyclonedx-py "%%path to pipenv python%%"
 
-    cyclonedx-py -p -o sbom.xml
+.. code-block:: doscon
+   :caption: Build an SBOM from Poetry environment
 
-**Pip**
+   > poetry.exe env info  --executable
+   > cyclonedx-py "%%path to poetry python%%"
 
-We currently support ``Pipfile.lock`` manifest files.
 
-You can then run ``cyclonedx-bom`` as follows:
 
-.. code-block:: sh
+For Pipenv
+----------
 
-    cyclonedx-py -pip -i PATH/TO/Pipfile.lock -o sbom.xml
+Support for `Pipenv`_ dependency management.
+This requires parsing your ``Pipfile`` and ``Pipfile.lock`` file which details exact pinned versions of dependencies.
 
+.. _Pipenv: https://pipenv.pypa.io/
 
-If your ``Pipfile.lock`` is in the current working directory, you can also shorten this to:
+The full documentation can be issued by running with ``--help``:
 
-.. code-block:: sh
+.. code-block:: shell-session
 
-    cyclonedx-pu -pip -o sbom.xml
+    $ cyclonedx-py pipenv --help
+    usage: cyclonedx-py pipenv [-h] [-v]
+                               [--short-PURLs]  [--output-reproducible]
+                               [--validate | --no-validate]
+                               [-o <file>] [--sv <version>] [--of <format>]
+                               [--categories <categories>] [-d]
+                               [--pypi-mirror <url>]
+                               [--pyproject <file>] [--mc-type <type>]
+                               [project-directory]
 
+    Build an SBOM from Pipenv manifest.
 
-**Requirements**
+    The options and switches mimic the respective ones from Pipenv CLI.
 
-We support ``requirements.txt`` manifest files. Note that a SBOM such as CycloneDX expects exact version numbers,
-therefore if you wish to generate a BOM from a ``requirements.txt``, these must be frozen. This can be accomplished via:
+    positional arguments:
+      project-directory     The project directory for Pipenv (default: current working directory)
+                            Unlike Pipenv tool, there is no auto-detection in this very tool. Please
+                            provide the actual directory that contains `Pipfile` and `Pipfile.lock`
 
-.. code-block:: sh
+    options:
+      -h, --help            show this help message and exit
+      --categories <categories>
+      -d, --dev             Analyse both develop and default packages
+                            [env var: PIPENV_DEV]
+      --pypi-mirror <url>   Specify a PyPI mirror
+                            [env var: PIPENV_PYPI_MIRROR]
+      --pyproject <file>    Path to the root component's `pyproject.toml` file.
+                            This should point to a file compliant with PEP 621 (storing project metadata).
+      --mc-type <type>      Type of the main component
+                            {choices: application, firmware, library}
+                            (default: ComponentType.APPLICATION)
+      --short-PURLs         Omit all qualifiers from PackageURLs.
+                            This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.
+      -o <file>, --outfile <file>
+                            Output file path for your SBOM
+                            (set to "-" to output to <stdout>)
+                            (default: -)
+      --sv <version>, --schema-version <version>
+                            The CycloneDX schema version for your SBOM
+                            {choices: 1.5, 1.4, 1.3, 1.2, 1.1, 1.0}
+                            (default: 1.5)
+      --of <format>, --output-format <format>
+                            The output format for your SBOM
+                            {choices: JSON, XML}
+                            (default: JSON)
+      --output-reproducible
+                            Whether to go the extra mile and make the output reproducible.
+                            This might result in loss of time- and random-based-values.
+      --validate, --no-validate
+                            Whether validate the result before outputting
+                            (default: True)
+      -v, --verbose         Increase the verbosity of messages
+                            (multiple for more effect)
+                            (default: silent)
 
-    pip freeze > requirements.txt
 
 
-You can then run ``cyclonedx-bom`` as follows:
+For Poetry
+----------
 
-.. code-block:: sh
+Support for `Poetry`_ dependency management and package manifest.
+This requires parsing your ``pyproject.toml`` and ``poetry.lock`` file which details exact pinned versions of dependencies.
 
-    cyclonedx-py -r -i PATH/TO/requirements.txt -o sbom.xml
+.. _Poetry: https://python-poetry.org/
 
-If your ``requirements.txt`` is in the current working directory, you can also shorten this to:
+The full documentation can be issued by running with ``--help``:
 
-.. code-block:: sh
+.. code-block:: shell-session
 
-    cyclonedx-py -r -o sbom.xml
+    $ cyclonedx-py poetry --help
+    usage: cyclonedx-py poetry [-h] [-v]
+                               [--short-PURLs] [--output-reproducible]
+                               [--validate | --no-validate]
+                               [-o <file>] [--sv <version>] [--of <format>]
+                               [--without GROUPS] [--with GROUPS] [--only GROUPS] [--no-dev]
+                               [-E EXTRAS | --all-extras]
+                               [--mc-type <type>]
+                               [project-directory]
 
+    Build an SBOM from Poetry project.
 
-This will generate a CycloneDX and output to STDOUT in XML using the default schema version `1.3`.
+    The options and switches mimic the respective ones from Poetry CLI.
 
-.. note::
+    positional arguments:
+      project-directory     The project directory for Poetry
+                            (default: current working directory)
+
+    options:
+      -h, --help            show this help message and exit
+      --without GROUPS      The dependency groups to ignore
+                            (multiple values allowed)
+      --with GROUPS         The optional dependency groups to include
+                            (multiple values allowed)
+      --only GROUPS         The only dependency groups to include
+                            (multiple values allowed)
+      --no-dev              Explicitly force: --only main
+      -E EXTRAS, --extras EXTRAS
+                            Extra sets of dependencies to include
+                            (multiple values allowed)
+      --all-extras          Include all extra dependencies
+                            (default: False)
+      --mc-type <type>        Type of the main component
+                            {choices: application, firmware, library}
+                            (default: ComponentType.APPLICATION)
+      --short-PURLs         Omit all qualifiers from PackageURLs.
+                            This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.
+      -o <file>, --outfile <file>
+                            Output file path for your SBOM
+                            (set to "-" to output to <stdout>)
+                            (default: -)
+      --sv <version>, --schema-version <version>
+                            The CycloneDX schema version for your SBOM
+                            {choices: 1.5, 1.4, 1.3, 1.2, 1.1, 1.0} (default: 1.5)
+      --of <format>, --output-format <format>
+                            The output format for your SBOM
+                            {choices: JSON, XML}
+                            (default: JSON)
+      --output-reproducible
+                            Whether to go the extra mile and make the output reproducible.
+                            This might result in loss of time- and random-based-values.
+      --validate, --no-validate
+                            Whether validate the result before outputting
+                            (default: True)
+      -v, --verbose         Increase the verbosity of messages
+                            (multiple for more effect)
+                            (default: silent)
+
+
+For Pip requirements
+--------------------
+
+Support for Pip's `requirements file format`_ dependency lists.
+
+.. _requirements file format: https://pip.pypa.io/en/stable/reference/requirements-file-format/
+
+The full documentation can be issued by running with ``--help``:
+
+.. code-block:: shell-session
+
+    $ cyclonedx-py requirements --help
+    usage: cyclonedx-py requirements [-h] [-v]
+                                     [--short-PURLs]  [--output-reproducible]
+                                     [--validate | --no-validate]
+                                     [-o <file>] [--sv <version>] [--of <format>]
+                                     [-i <url>] [--extra-index-url <url>]
+                                     [--pyproject <file>] [--mc-type <type>]
+                                     [<requirements-file>]
+
+    Build an SBOM from Pip requirements.
+
+    The options and switches mimic the respective ones from Pip CLI.
+
+    positional arguments:
+      <requirements-file>   Path to requirements file.
+                            May be set to "-" to read from <stdin>.
+                            (default: 'requirements.txt' in current working directory)
+
+    options:
+      -h, --help            show this help message and exit
+      -i <url>, --index-url <url>
+                            Base URL of the Python Package Index.
+                            This should point to a repository compliant with PEP 503 (the simple repository API)
+                            or a local directory laid out in the same format.
+                            (default: https://pypi.org/simple)
+      --extra-index-url <url>
+                            Extra URLs of package indexes to use in addition to --index-url.
+                            Should follow the same rules as --index-url
+      --pyproject <file>    Path to the root component's `pyproject.toml` file.
+                            This should point to a file compliant with PEP 621 (storing project metadata).
+      --mc-type <type>      Type of the main component
+                            {choices: application, firmware, library}
+                            (default: ComponentType.APPLICATION)
+      --short-PURLs         Omit all qualifiers from PackageURLs.
+                            This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.
+      -o <file>, --outfile <file>
+                            Output file path for your SBOM
+                            (set to "-" to output to <stdout>)
+                            (default: -)
+      --sv <version>, --schema-version <version>
+                            The CycloneDX schema version for your SBOM
+                            {choices: 1.5, 1.4, 1.3, 1.2, 1.1, 1.0}
+                            (default: 1.5)
+      --of <format>, --output-format <format>
+                            The output format for your SBOM
+                            {choices: JSON, XML}
+                            (default: JSON)
+      --output-reproducible
+                            Whether to go the extra mile and make the output reproducible.
+                            This might result in loss of time- and random-based-values.
+      --validate, --no-validate
+                            Whether validate the result before outputting
+                            (default: True)
+      -v, --verbose         Increase the verbosity of messages
+                            (multiple for more effect)
+                            (default: silent)
+
+
+Example Usage
+~~~~~~~~~~~~~
+
+.. code-block:: shell-session
+   :caption: Build an SBOM from a requirements file
+
+    $ cyclonedx-py requirements requirements-prod.txt
+
+.. code-block:: shell-session
+   :caption: Merge multiple files and build an SBOM from it
+
+    $ cat requirements/*.txt | cyclonedx-py requirements -
+
+
+.. code-block:: shell-session
+   :caption: Build an inventory for all installed packages
+
+    $ python -m pip freeze --all | cyclonedx-py requirements -
+
+.. code-block:: shell-session
+   :caption: Build an inventory for all installed packages in a conda environment
+
+    $ conda run python -m pip freeze --all | cyclonedx-py requirements -
+
+.. code-block:: shell-session
+   :caption: Build an inventory for installed packages in a Python (virtual) environment
+
+    $ .../.venv/bin/python -m pip freeze --all --local --require-virtualenv |\
+      cyclonedx-py requirements -
+
+.. code-block:: shell-session
+   :caption: Build an inventory from an unfrozen manifest
+
+    $ python -m pip install -r dependencies.txt &&\
+      python -m pip freeze | cyclonedx-py requirements -
+
+
+
+For Conda
+---------
+
+`Conda`_ is a package manager for all kinds on environments.
+
+However, since conda it might manage a python environment under the hood,
+it is possible to utilize the functionality for Python environments as described above.
+
+.. _conda: https://conda.io/
+
+
+
+*****
 
-    If you failed to freeze your dependencies before passing the ``requirements.txt`` data to ``cyclonedx-bom``,
-    you'll be warned about this and the dependencies that do not have pinned versions WILL NOT be included in the
-    resulting CycloneDX output.
 
 
 Programmatic Usage
 ------------------
 
-This library provides a number of concrete implementations of :py:mod:`cyclondex.parser.BaserParser`.
-Parsers are provided as a quick way to generate a BOM for Python applications or from Python environments.
+This tool utilizes the `CycloneDX Python library`_ to generate the actual data structures, and serialize and validate them.
 
-    **WARNING**: Limited information will be available when generating a BOM using some Parsers due to limited
-    information kept/supplied by those package managers. See below for details of what fields can be completed by
-    different Parsers.
+This tool does **not** expose any additional *public* API or classes - all code is intended to be internal and might change without any notice during version upgrades.
 
-Easily create your parser instance as follows:
+.. _CycloneDX Python library: https://pypi.org/project/cyclonedx-python-lib
+
+However, the CLI is stable - you may call it programmatically like:
 
 .. code-block:: python
 
-   from cyclonedx_py.parser.environment import EnvironmentParser
-
-   parser = EnvironmentParser()
-
-Conda
-~~~~~
-
-* :py:mod:`cyclonedx_py.parser.conda.CondaListJsonParser`: Parses input provided as a ``str`` that is output from
-  ``conda list --json``
-* :py:mod:`cyclonedx_py.parser.conda.CondaListExplicitParser`: Parses input provided as a ``str`` that is output from:
-  ``conda list --explicit`` or ``conda list --explicit --md5``
-
-Environment
-~~~~~~~~~~~
-
-* :py:mod:`cyclonedx_py.parser.environment.EnvironmentParser`: Looks at the packages installed in your current Python
-  environment
-
-Pip
-~~~~~~~
-
-* :py:mod:`cyclonedx_py.parser.pipenv.PipEnvParser`: Parses ``Pipfile.lock`` content passed in as a string
-* :py:mod:`cyclonedx_py.parser.pipenv.PipEnvFileParser`: Parses the ``Pipfile.lock`` file at the supplied path
-
-Poetry
-~~~~~~
-
-* :py:mod:`cyclonedx.parser.poetry.PoetryParser`: Parses ``poetry.lock`` content passed in as a string
-* :py:mod:`cyclonedx.parser.poetry.PoetryFileParser`: Parses the ``poetry.lock`` file at the supplied path
-
-Requirements
-~~~~~~~~~~~~
-
-* :py:mod:`cyclonedx_py.parser.requirements.RequirementsParser`: Parses a multiline string that you provide that conforms
-  to the ``requirements.txt`` :pep:`508` standard.
-* :py:mod:`cyclonedx_py.parser.requirements.RequirementsFileParser`: Parses a file that you provide the path to that conforms to the ``requirements.txt`` :pep:`508` standard.
-  It supports nested files, so if there is a line in your ``requirements.txt`` file with the ``-r requirements-nested.txt`` syntax, it'll parse the nested file as part of the same file.
-
-CycloneDX software bill-of-materials require pinned versions of requirements. If your `requirements.txt` does not have
-pinned versions, warnings will be recorded and the dependencies without pinned versions will be excluded from the
-generated CycloneDX. CycloneDX schemas (from version 1.0+) require a component to have a version when included in a
-CycloneDX bill of materials (according to schema).
-
-If you need to use a ``requirements.txt`` in your project that does not have pinned versions an acceptable workaround
-might be to:
-
-.. code-block:: sh
-
-   pip install -r requirements.txt
-   pip freeze > requirements-frozen.txt
-
-You can then feed in the frozen requirements from ``requirements-frozen.txt`` `or` use the ``Environment`` parser once
-you have installed your dependencies.
-
-Parser Schema Support
----------------------
-
-Different parsers support population of different information about your dependencies due to how information is
-obtained and limitations of what information is available to each Parser. The sections below explain coverage as to what
-information is obtained by each set of Parsers. It does NOT guarantee the information is output in the resulting
-CycloneDX BOM document.
-
-The below tables do not state whether specific schema versions support the attributes/items, just whether this library
-does.
-
-xPath is used to refer to data attributes according to the `Cyclone DX Specification`_.
-
-``bom.components.component``
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-+-------------------------+-------------------------------------------------------------------+
-|                         | Parser Support                                                    |
-| Data Path               +------------+-------------+------------+------------+--------------+
-|                         | Conda      | Environment | Pip        | Poetry     | Requirements |
-+=========================+============+=============+============+============+==============+
-| ``.supplier``           | N          | N - Note 1  | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.author``             | N          | Y - Note 1  | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.publisher``          | N          | N - Note 1  | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.group``              | N          | N           | N          | N          | N            |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.name``               | Y          | Y           | Y          | Y          | Y            |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.version``            | Y          | Y           | Y          | Y          | Y            |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.description``        | N          | N           | N/A        | N          | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.scope``              | N          | N           | N/A        | N          | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.hashes``             | Y - Note 2 | N/A         | Y - Note 3 | Y - Note 3 | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.licenses``           | N          | Y - Note 1  | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.copyright``          | N          | N - Note 1  | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.cpe``                | N/A        | N/A         | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.purl``               | Y          | Y           | Y          | Y          | Y            |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.swid``               | N/A        | N/A         | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.modified``           | *Deprecated - not used*                                           |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.pedigree``           | N/A        | N/A         | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.externalReferences`` | Y - Note 3 | N/A         | Y - Note 1 | Y - Note 1 | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.properties``         | N/A        | N/A         | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.components``         | N/A        | N/A         | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.evidence``           | N/A        | N/A         | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-| ``.releaseNotes``       | N/A        | N/A         | N/A        | N/A        | N/A          |
-+-------------------------+------------+-------------+------------+------------+--------------+
-
-    **Legend:**
-
-    * **Y**: YES with any caveat states.
-    * **N**: Not currently supported, but support believed to be possible.
-    * **N/A**: Not supported and not deemed possible (i.e. the Parser would never be able to reliably determine this
-      info).
-
-**Notes**
-
-1. If contained in the packages ``METADATA``
-2. MD5 hashes are available when using the ``CondaListExplicitParser`` with output from the
-   conda command ``conda list --explicit --md5`` only
-3. Python packages are regularly available as both ``.whl`` and ``.tar.gz`` packages. This means for that for a given
-   package and version multiple artefacts are possible - which would mean multiple hashes are possible. CycloneDX
-   supports only a single set of hashes identifying a single artefact at ``component.hashes``. To cater for this
-   situation in Python, we add the hashes to `component.externalReferences`, as we cannot determine which package was
-   actually obtained and installed to meet a given dependency.
-
-.. _Cyclone DX Specification: https://cyclonedx.org/docs/latest
+   from sys import executable
+   from subprocess import run
+   run((executable, '-m', 'cyclonedx_py', '--help'))
+
